diff --git a/.env.development.example b/.env.development.example
index 56c17128ce..380f10a446 100644
--- a/.env.development.example
+++ b/.env.development.example
@@ -53,4 +53,3 @@ DUSK_DRIVER_URL=http://selenium:4444
 BUNNY_API_KEY=
 # For asset uploads
 BUNNY_STORAGE_API_KEY=
-AVATAR_CDN_URL=
diff --git a/.env.windows-docker-desktop.example b/.env.windows-docker-desktop.example
index 626d76ff63..b067b4c5c0 100644
--- a/.env.windows-docker-desktop.example
+++ b/.env.windows-docker-desktop.example
@@ -11,4 +11,3 @@ REDIS_PASSWORD=coolify
 PUSHER_APP_ID=coolify
 PUSHER_APP_KEY=coolify
 PUSHER_APP_SECRET=coolify
-AVATAR_CDN_URL=
diff --git a/DESIGN.md b/DESIGN.md
index a7b26bb666..53b058ddef 100644
--- a/DESIGN.md
+++ b/DESIGN.md
@@ -34,7 +34,9 @@ The interface is compact and product-focused:
 
 - near-neutral layered surfaces instead of large bordered boxes;
 - 13–14px UI typography and 32px controls;
-- hairline rings instead of heavy borders;
+- crisp hairline rings plus a restrained card lift (single 1px ring +
+  `0 1px 2px rgb(0 0 0 / 0.05)`) so cards and tables separate from the canvas,
+  never heavy borders or a strong floating shadow;
 - full-width data tables for dense collections;
 - outline Reicon glyphs through `<x-reicon>`;
 - the Coolify purple brand accent in light mode;
@@ -49,6 +51,19 @@ Avoid oversized titles, generic dashboard cards, strong shadows, thick
 dividers, native browser selects, and isolated colored buttons that do not
 match the current action styles.
 
+Standard `.button` controls use a compact 2px bottom depth. Hover raises the
+button face by 1px and increases the visible depth to 3px. Pressing moves the
+face down 2px into the edge and removes the depth until release, keeping the
+overall bottom position stable. Disabled controls stay flat,
+and focus-visible controls retain the accent ring alongside the depth.
+Movement and depth-shadow changes transition over 80ms; color transitions keep
+the shared 120ms duration.
+Standard button labels use `capitalize`, giving each word an initial capital.
+Highlighted buttons mix the accent equally with black for a pronounced bottom
+edge, so custom theme colors produce a matching edge instead of a generic one.
+Dark mode matches the depth edge of neutral buttons to their regular border
+color. Highlighted buttons keep their dark, color-matched accent edge.
+
 ---
 
 ## 2. Development and cascade notes
@@ -89,14 +104,14 @@ The surface ladder is defined in `resources/css/app.css`.
 
 | Token | Light | Dark | Use |
 |---|---|---|---|
-| `--coollabs-canvas` | near white | 10% neutral | page canvas |
+| `--coollabs-canvas` | 97% off-white | 10% neutral | page canvas (kept below card fills so cards lift) |
 | `--coollabs-elevated` | 98% neutral | 15% neutral | shells and card headers |
 | `--coollabs-base` | white | 17% neutral | nested card bodies |
 | `--coollabs-recessed` | 96% neutral | 20% neutral | inputs and listboxes |
 | `--coollabs-fill` | 92.2% neutral | 26.9% neutral | dividers and passive fills |
 | `--coollabs-line` | translucent dark | 32% neutral | control borders |
-| `--coollabs-hairline` | 93.5% neutral | 26.9% neutral | shell rings |
-| `--coollabs-subtle` | 55.6% neutral | 70.8% neutral | labels and muted titles |
+| `--coollabs-hairline` | 85.5% neutral | 32% neutral | shell rings (crisp enough to read as a card edge, ~1.5:1) |
+| `--coollabs-subtle` | 50% neutral | 70.8% neutral | labels and muted titles (light darkened for WCAG AA 4.5:1) |
 
 Accent behavior is intentionally theme-aware:
 
@@ -116,6 +131,38 @@ dark:bg-warning/15 dark:text-warning dark:ring-warning/25
 The filled top-level action/tab treatment uses the same palette at a restrained
 opacity rather than a fully saturated fill.
 
+### Shell layering
+
+The app shell is three distinct surface layers, not one flat color. Chrome
+lifts, content is the base, cards lift off the content:
+
+- **Content canvas** is the base layer: `bg-app` in dark (deepest,
+  `--color-app` `#0a0a0b`), `bg-gray-50` in light. The `<main>` content area
+  and page body use it.
+- **Sidebar and topbar chrome** use `bg-panel` in dark (`--color-panel`
+  `#141418`, a clear step lighter than the content canvas) and `bg-white` in
+  light, so the chrome reads as a separate panel from the content.
+
+Dark surface tokens are hex, not oklch. oklch lightness compresses toward pure
+black below ~15% (oklch(10%) renders as sRGB 3, oklch(15%) as sRGB 11), so oklch
+values there give no visible step between layers. The dark ladder is
+`--color-app` 10, `--coollabs-elevated` 22, `--coollabs-base` 28,
+`--coollabs-recessed` 34 (sRGB), which reads as distinct surfaces.
+
+Temperature: every panel is **pure neutral gray** (r=g=b), one consistent
+temperature across the sidebar, tables, cards, inputs, dividers, borders, and
+text, in both modes. Do not give one surface a cool (blue) or warm cast while
+the others stay neutral. The light page canvas uses `bg-neutral-50` (not
+`bg-gray-50`, which is faintly cool) so it matches the neutral cards and chrome.
+The only intentional color is the purple/yellow brand accent.
+- **Cards, tables, and collection tiles** lift off the content canvas with
+  `dark:bg-white/[0.05]` plus the crisp `--coollabs-hairline` ring; in light
+  they are `bg-white` with the ring and the restrained card lift.
+
+Do not paint the content area with the same `bg-panel` as the sidebar, and do
+not drop card fills below `dark:bg-white/[0.05]`; both make surfaces read as one
+color. Row-hover states keep the lighter `dark:hover:bg-white/[0.025]`.
+
 ---
 
 ## 4. Page shells and navigation
@@ -419,6 +466,12 @@ The popup panel uses a 10px radius around 6px options with a 4px inset. Keep
 the option content left-aligned and size the panel to its content or trigger;
 do not create an unnecessarily wide menu.
 
+Every dropdown, menu, listbox panel, and the command palette uses the shared
+`--shadow-dropdown` token (`0 4px 12px rgb(0 0 0 / 0.12), 0 2px 4px
+rgb(0 0 0 / 0.08)`) for a restrained, consistent lift. Do not hand-roll a
+heavier `shadow-lg` / `0 18px 50px` / `0.45`-alpha drop shadow on a menu.
+Reserve the stronger `--shadow-modal` for actual modals, dialogs, and toasts.
+
 Toolbar filter and sort buttons keep static labels (`Filter`, `Sort`). The
 selected option is indicated inside the menu, not repeated on the trigger.
 
@@ -520,7 +573,10 @@ Do not restore the old full-width footer.
 Deferred fields in one Livewire component use one floating unsaved bar and one
 submit action. Do not add a separate “Save configuration” button to every
 card. Selectors that are safe to persist independently should use the existing
-instant-save pattern.
+instant-save pattern. When those requests share a component with a modal draft,
+pass the unsaved bar a `dirty` Alpine expression comparing that draft with its
+initial values, so unrelated saves do not hide pending changes. Mount modal save
+bars only while the modal is open to avoid inactive keyboard shortcuts.
 
 ---
 
@@ -567,6 +623,15 @@ that hide secondary columns before allowing horizontal overflow.
 
 ---
 
+### Domain rows on mobile
+
+Domain tables become compact summary cards below 600px. Keep the public URL on
+its own line, followed by a short routing summary such as `HTTP → HTTPS · Port
+80 · Noindex`. Put DNS status and the existing icon actions on the final row.
+Do not squeeze desktop label/value columns into a mobile card or move settings
+behind an overflow menu. Long domains wrap, and icon actions retain 40px touch
+targets.
+
 ## 8. Modals, confirmations, and toasts
 
 ### Modals
@@ -626,8 +691,9 @@ Current toast behavior:
 - Reicon status tile for success, info, warning, danger, or default;
 - title plus optional description;
 - dismiss and copy-details actions;
-- up to four stacked notifications;
+- normally up to four stacked notifications, without evicting persistent notices;
 - four-second dismissal, paused while hovered;
+- `persistent: true` disables automatic dismissal, including after hover; users close these notices with the dismiss button;
 - support for all six screen positions and sanitized custom HTML.
 
 Do not bring back the old oversized dark rectangle.
diff --git a/app/Actions/Stripe/CreateCheckoutSession.php b/app/Actions/Stripe/CreateCheckoutSession.php
new file mode 100644
index 0000000000..42d14c0f25
--- /dev/null
+++ b/app/Actions/Stripe/CreateCheckoutSession.php
@@ -0,0 +1,221 @@
+<?php
+
+namespace App\Actions\Stripe;
+
+use App\Exceptions\CheckoutUnavailableException;
+use App\Models\Subscription;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\Log;
+use Stripe\Stripe;
+use Stripe\StripeClient;
+use Throwable;
+
+class CreateCheckoutSession
+{
+    private const BLOCKING_SUBSCRIPTION_STATUSES = [
+        'active',
+        'incomplete',
+        'past_due',
+        'paused',
+        'trialing',
+        'unpaid',
+    ];
+
+    private const RECOVERABLE_SUBSCRIPTION_STATUSES = [
+        'incomplete',
+        'past_due',
+        'paused',
+        'unpaid',
+    ];
+
+    public function __construct(private ?StripeClient $stripe = null)
+    {
+        $this->stripe ??= app(StripeClient::class);
+    }
+
+    public static function lockKey(int $teamId): string
+    {
+        return "stripe-checkout:team:{$teamId}";
+    }
+
+    public function execute(Team $team, User $user, string $priceId): object
+    {
+        $lock = Cache::lock(self::lockKey($team->id), 30);
+
+        if (! $lock->get()) {
+            throw new CheckoutUnavailableException('A subscription checkout is already being created for this team.');
+        }
+
+        $previousMaxNetworkRetries = Stripe::getMaxNetworkRetries();
+        Stripe::setMaxNetworkRetries(2);
+
+        try {
+            return $this->createOrReuseSession($team, $user, $priceId);
+        } finally {
+            Stripe::setMaxNetworkRetries($previousMaxNetworkRetries);
+            $lock->release();
+        }
+    }
+
+    private function createOrReuseSession(Team $team, User $user, string $priceId): object
+    {
+        $subscription = Subscription::query()->firstOrNew(['team_id' => $team->id]);
+        $customerId = $subscription->stripe_customer_id;
+
+        if (! $customerId) {
+            $customer = $this->stripe->customers->create([
+                'email' => $user->email,
+                'metadata' => [
+                    'team_id' => $team->id,
+                ],
+            ], [
+                'idempotency_key' => "coolify-team-{$team->id}-customer",
+            ]);
+            $customerId = $customer->id;
+            $subscription->stripe_customer_id = $customerId;
+            $subscription->save();
+
+            Log::info('Stripe customer assigned for subscription checkout.', [
+                'team_id' => $team->id,
+                'stripe_customer_id' => $customerId,
+            ]);
+        }
+
+        $blockingSubscription = null;
+        foreach ($this->stripe->subscriptions->all([
+            'customer' => $customerId,
+            'limit' => 10,
+            'status' => 'all',
+        ])->autoPagingIterator() as $stripeSubscription) {
+            if (in_array($stripeSubscription->status, self::BLOCKING_SUBSCRIPTION_STATUSES, true)) {
+                $blockingSubscription = $stripeSubscription;
+                break;
+            }
+        }
+
+        $this->throwIfBlockingSubscription($team, $customerId, $blockingSubscription);
+
+        $sessions = $this->stripe->checkout->sessions->all([
+            'customer' => $customerId,
+            'limit' => 10,
+            'status' => 'open',
+        ]);
+        $subscriptionSessions = collect($sessions->data)->filter(
+            fn (object $session): bool => ($session->mode ?? null) === 'subscription'
+        );
+        $openSession = $subscriptionSessions->first(
+            fn (object $session): bool => ($session->status ?? null) === 'open'
+        );
+
+        if ($openSession) {
+            $lineItems = $this->stripe->checkout->sessions->allLineItems($openSession->id);
+            if (count($lineItems->data) === 1 && data_get($lineItems, 'data.0.price.id') === $priceId) {
+                Log::info('Reusing pending Stripe subscription checkout.', [
+                    'team_id' => $team->id,
+                    'stripe_customer_id' => $customerId,
+                    'stripe_checkout_session_id' => $openSession->id,
+                    'stripe_subscription_id' => $openSession->subscription ?? null,
+                ]);
+
+                return $openSession;
+            }
+
+            $this->stripe->checkout->sessions->expire($openSession->id);
+        }
+
+        $session = $this->stripe->checkout->sessions->create([
+            'allow_promotion_codes' => true,
+            'billing_address_collection' => 'required',
+            'client_reference_id' => $user->id.':'.$team->id,
+            'customer' => $customerId,
+            'customer_update' => [
+                'name' => 'auto',
+                'address' => 'auto',
+            ],
+            'line_items' => [[
+                'price' => $priceId,
+                'adjustable_quantity' => [
+                    'enabled' => true,
+                    'minimum' => 2,
+                ],
+                'quantity' => 2,
+            ]],
+            'tax_id_collection' => [
+                'enabled' => true,
+            ],
+            'automatic_tax' => [
+                'enabled' => true,
+            ],
+            'subscription_data' => [
+                'metadata' => [
+                    'user_id' => $user->id,
+                    'team_id' => $team->id,
+                ],
+            ],
+            'payment_method_collection' => 'if_required',
+            'mode' => 'subscription',
+            'expires_at' => now()->addMinutes(35)->timestamp,
+            'success_url' => route('dashboard', ['success' => true]),
+            'cancel_url' => route('subscription.index', ['cancelled' => true]),
+        ]);
+
+        Log::info('Stripe subscription checkout created.', [
+            'team_id' => $team->id,
+            'stripe_customer_id' => $customerId,
+            'stripe_checkout_session_id' => $session->id,
+            'stripe_subscription_id' => $session->subscription ?? null,
+        ]);
+
+        return $session;
+    }
+
+    private function throwIfBlockingSubscription(Team $team, string $customerId, ?object $blockingSubscription): void
+    {
+        if (! $blockingSubscription) {
+            return;
+        }
+
+        Log::warning('Stripe subscription checkout blocked by existing subscription.', [
+            'team_id' => $team->id,
+            'stripe_customer_id' => $customerId,
+            'stripe_subscription_id' => $blockingSubscription->id,
+            'stripe_subscription_status' => $blockingSubscription->status,
+        ]);
+
+        $portalUrl = in_array($blockingSubscription->status, self::RECOVERABLE_SUBSCRIPTION_STATUSES, true)
+            ? $this->billingPortalUrl($customerId)
+            : null;
+
+        throw new CheckoutUnavailableException(
+            $this->blockingSubscriptionMessage($blockingSubscription->status),
+            $portalUrl,
+        );
+    }
+
+    private function blockingSubscriptionMessage(string $status): string
+    {
+        return match ($status) {
+            'incomplete' => "This team's subscription payment is incomplete. Complete the payment in the billing portal.",
+            'past_due' => "This team's subscription payment is past due. Update the payment method or settle the outstanding invoice in the billing portal.",
+            'unpaid' => "This team's subscription is unpaid. Settle the outstanding invoice in the billing portal.",
+            'paused' => "This team's subscription is paused. Resume it in the billing portal.",
+            default => 'Team already has an active subscription.',
+        };
+    }
+
+    private function billingPortalUrl(string $customerId): ?string
+    {
+        try {
+            $session = $this->stripe->billingPortal->sessions->create([
+                'customer' => $customerId,
+                'return_url' => route('subscription.show'),
+            ]);
+        } catch (Throwable) {
+            return null;
+        }
+
+        return is_string($session->url ?? null) ? $session->url : null;
+    }
+}
diff --git a/app/Console/Kernel.php b/app/Console/Kernel.php
index 8eb010b8ac..79660c2490 100644
--- a/app/Console/Kernel.php
+++ b/app/Console/Kernel.php
@@ -5,6 +5,7 @@ namespace App\Console;
 use App\Jobs\ApiTokenExpirationWarningJob;
 use App\Jobs\CheckForUpdatesJob;
 use App\Jobs\CheckHelperImageJob;
+use App\Jobs\CheckMissingDatabaseBackupsJob;
 use App\Jobs\CheckTraefikVersionJob;
 use App\Jobs\CleanupInstanceStuffsJob;
 use App\Jobs\CleanupOrphanedPreviewContainersJob;
@@ -53,6 +54,7 @@ class Kernel extends ConsoleKernel
             ->runInBackground();
         $this->scheduleInstance->command('sanctum:prune-expired --hours=1')->hourly()->onOneServer();
         $this->scheduleInstance->job(new ApiTokenExpirationWarningJob)->hourly()->onOneServer();
+        $this->scheduleInstance->job(new CheckMissingDatabaseBackupsJob)->hourly()->onOneServer();
 
         if (isDev()) {
             // Instance Jobs
diff --git a/app/Exceptions/CheckoutUnavailableException.php b/app/Exceptions/CheckoutUnavailableException.php
new file mode 100644
index 0000000000..329941dbc6
--- /dev/null
+++ b/app/Exceptions/CheckoutUnavailableException.php
@@ -0,0 +1,18 @@
+<?php
+
+namespace App\Exceptions;
+
+use Exception;
+use Throwable;
+
+class CheckoutUnavailableException extends Exception
+{
+    public function __construct(
+        string $message = '',
+        public readonly ?string $billingPortalUrl = null,
+        int $code = 0,
+        ?Throwable $previous = null,
+    ) {
+        parent::__construct($message, $code, $previous);
+    }
+}
diff --git a/app/Exceptions/Handler.php b/app/Exceptions/Handler.php
index 4b4df49711..c3a52ea356 100644
--- a/app/Exceptions/Handler.php
+++ b/app/Exceptions/Handler.php
@@ -4,9 +4,11 @@ namespace App\Exceptions;
 
 use App\Models\InstanceSettings;
 use App\Models\User;
+use App\Providers\RouteServiceProvider;
 use Illuminate\Auth\Access\AuthorizationException;
 use Illuminate\Auth\AuthenticationException;
 use Illuminate\Foundation\Exceptions\Handler as ExceptionHandler;
+use Illuminate\Session\TokenMismatchException;
 use Psr\Log\LogLevel;
 use RuntimeException;
 use Sentry\Laravel\Integration;
@@ -69,6 +71,11 @@ class Handler extends ExceptionHandler
      */
     public function render($request, Throwable $e)
     {
+        // A duplicate login or 2FA submission carries a stale token on an already authenticated session, see https://github.com/coollabsio/coolify/issues/10670
+        if ($e instanceof TokenMismatchException && $request->routeIs('login.store', 'two-factor.login.store') && $request->user()) {
+            return redirect()->intended(RouteServiceProvider::HOME);
+        }
+
         // Handle authorization exceptions for API routes. Exceptions carrying
         // an explicit status (e.g. denyAsNotFound) keep it via parent::render.
         if ($e instanceof AuthorizationException && ! $e->hasStatus()) {
diff --git a/app/Http/Controllers/Api/ApplicationsController.php b/app/Http/Controllers/Api/ApplicationsController.php
index 487d319e18..dbe0f86336 100644
--- a/app/Http/Controllers/Api/ApplicationsController.php
+++ b/app/Http/Controllers/Api/ApplicationsController.php
@@ -27,6 +27,7 @@ use App\Support\DomainPortOverrides;
 use App\Support\ValidationPatterns;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
+use Illuminate\Support\Collection;
 use Illuminate\Support\Facades\Http;
 use Illuminate\Support\Facades\Validator;
 use Illuminate\Validation\Rule;
@@ -1455,7 +1456,9 @@ class ApplicationsController extends Controller
                 $request->offsetUnset('docker_compose_domains');
             }
             if ($dockerComposeDomainsJson->count() > 0) {
+                [$dockerComposeDomainsJson, $domainPortOverrides] = $this->normalizeDockerComposeDomainPorts($dockerComposeDomainsJson);
                 $application->docker_compose_domains = json_encode($dockerComposeDomainsJson);
+                $application->domain_port_overrides = $domainPortOverrides;
             }
             $repository_url_parsed = Url::fromString($request->git_repository);
             $git_host = $repository_url_parsed->getHost();
@@ -1719,7 +1722,9 @@ class ApplicationsController extends Controller
                 $request->offsetUnset('docker_compose_domains');
             }
             if ($dockerComposeDomainsJson->count() > 0) {
+                [$dockerComposeDomainsJson, $domainPortOverrides] = $this->normalizeDockerComposeDomainPorts($dockerComposeDomainsJson);
                 $application->docker_compose_domains = json_encode($dockerComposeDomainsJson);
+                $application->domain_port_overrides = $domainPortOverrides;
             }
             $application->fqdn = $fqdn;
             $application->git_repository = str($gitRepository)->trim()->toString();
@@ -1950,7 +1955,9 @@ class ApplicationsController extends Controller
                 $request->offsetUnset('docker_compose_domains');
             }
             if ($dockerComposeDomainsJson->count() > 0) {
+                [$dockerComposeDomainsJson, $domainPortOverrides] = $this->normalizeDockerComposeDomainPorts($dockerComposeDomainsJson);
                 $application->docker_compose_domains = json_encode($dockerComposeDomainsJson);
+                $application->domain_port_overrides = $domainPortOverrides;
             }
             $application->fqdn = $fqdn;
             $application->private_key_id = $privateKey->id;
@@ -3369,7 +3376,12 @@ class ApplicationsController extends Controller
         }
 
         if ($dockerComposeDomainsJson->count() > 0) {
+            [$dockerComposeDomainsJson, $domainPortOverrides] = $this->normalizeDockerComposeDomainPorts(
+                $dockerComposeDomainsJson,
+                $application->domain_port_overrides,
+            );
             data_set($data, 'docker_compose_domains', json_encode($dockerComposeDomainsJson));
+            data_set($data, 'domain_port_overrides', $domainPortOverrides);
         }
         $requestHasNoindexDomains = $request->has('noindex_domains');
         data_forget($data, 'noindex_domains');
@@ -6116,4 +6128,28 @@ class ApplicationsController extends Controller
 
         return response()->json(['message' => 'Destination detached.']);
     }
+
+    /**
+     * @param  Collection<string, array{domain: ?string, redirect?: string}>  $domains
+     * @param  array<string, int|string>|null  $existingOverrides
+     * @return array{Collection<string, array{domain: ?string, redirect?: string}>, ?array<string, int>}
+     */
+    private function normalizeDockerComposeDomainPorts(Collection $domains, ?array $existingOverrides = null): array
+    {
+        $allDomains = $domains
+            ->pluck('domain')
+            ->filter()
+            ->implode(',');
+        $normalized = DomainPortOverrides::normalize($allDomains, $existingOverrides);
+
+        $domains = $domains->map(function (array $entry): array {
+            $entry['domain'] = collect(ValidationPatterns::applicationDomainList($entry['domain'] ?? null))
+                ->map(fn (string $domain): string => DomainPortOverrides::withoutPort($domain))
+                ->implode(',');
+
+            return $entry;
+        });
+
+        return [$domains, $normalized['overrides']];
+    }
 }
diff --git a/app/Http/Controllers/Api/DatabasesController.php b/app/Http/Controllers/Api/DatabasesController.php
index aeb69ac8b4..881aa5a897 100644
--- a/app/Http/Controllers/Api/DatabasesController.php
+++ b/app/Http/Controllers/Api/DatabasesController.php
@@ -769,6 +769,7 @@ class DatabasesController extends Controller
                         'database_backup_retention_days_s3' => ['type' => 'integer', 'description' => 'Number of days to retain backups in S3'],
                         'database_backup_retention_max_storage_s3' => ['type' => 'number', 'description' => 'Max storage (GB) for S3 backups'],
                         'timeout' => ['type' => 'integer', 'description' => 'Backup job timeout in seconds (min: 60, max: 36000)', 'default' => 3600],
+                        'missing_backup_notification_days' => ['type' => 'integer', 'description' => 'Alert after this many days without an execution; 0 disables alerts', 'minimum' => 0, 'maximum' => 365, 'default' => 0],
                     ],
                 ),
             )
@@ -805,7 +806,7 @@ class DatabasesController extends Controller
     )]
     public function create_backup(Request $request)
     {
-        $backupConfigFields = ['save_s3', 'enabled', 'dump_all', 'frequency', 'databases_to_backup', 'database_backup_retention_amount_locally', 'database_backup_retention_days_locally', 'database_backup_retention_max_storage_locally', 'database_backup_retention_amount_s3', 'database_backup_retention_days_s3', 'database_backup_retention_max_storage_s3', 's3_storage_uuid', 'timeout'];
+        $backupConfigFields = ['save_s3', 'enabled', 'dump_all', 'frequency', 'databases_to_backup', 'database_backup_retention_amount_locally', 'database_backup_retention_days_locally', 'database_backup_retention_max_storage_locally', 'database_backup_retention_amount_s3', 'database_backup_retention_days_s3', 'database_backup_retention_max_storage_s3', 's3_storage_uuid', 'timeout', 'missing_backup_notification_days'];
 
         $teamId = getTeamIdFromToken();
         if (is_null($teamId)) {
@@ -833,6 +834,7 @@ class DatabasesController extends Controller
             'database_backup_retention_days_s3' => 'integer|min:0',
             'database_backup_retention_max_storage_s3' => 'numeric|min:0',
             'timeout' => 'integer|min:60|max:36000',
+            'missing_backup_notification_days' => 'integer|min:0|max:365',
         ]);
 
         if ($validator->fails()) {
@@ -1025,6 +1027,7 @@ class DatabasesController extends Controller
                         'database_backup_retention_days_s3' => ['type' => 'integer', 'description' => 'Retention days of the backup in s3'],
                         'database_backup_retention_max_storage_s3' => ['type' => 'number', 'description' => 'Max storage of the backup in S3'],
                         'timeout' => ['type' => 'integer', 'description' => 'Backup job timeout in seconds (min: 60, max: 36000)', 'default' => 3600],
+                        'missing_backup_notification_days' => ['type' => 'integer', 'description' => 'Alert after this many days without an execution; 0 disables alerts', 'minimum' => 0, 'maximum' => 365],
                     ],
                 ),
             )
@@ -1054,7 +1057,7 @@ class DatabasesController extends Controller
     )]
     public function update_backup(Request $request)
     {
-        $backupConfigFields = ['save_s3', 'enabled', 'dump_all', 'frequency', 'databases_to_backup', 'database_backup_retention_amount_locally', 'database_backup_retention_days_locally', 'database_backup_retention_max_storage_locally', 'database_backup_retention_amount_s3', 'database_backup_retention_days_s3', 'database_backup_retention_max_storage_s3', 's3_storage_uuid', 'timeout'];
+        $backupConfigFields = ['save_s3', 'enabled', 'dump_all', 'frequency', 'databases_to_backup', 'database_backup_retention_amount_locally', 'database_backup_retention_days_locally', 'database_backup_retention_max_storage_locally', 'database_backup_retention_amount_s3', 'database_backup_retention_days_s3', 'database_backup_retention_max_storage_s3', 's3_storage_uuid', 'timeout', 'missing_backup_notification_days'];
 
         $teamId = getTeamIdFromToken();
         if (is_null($teamId)) {
@@ -1080,6 +1083,7 @@ class DatabasesController extends Controller
             'database_backup_retention_days_s3' => 'integer|min:0',
             'database_backup_retention_max_storage_s3' => 'numeric|min:0',
             'timeout' => 'integer|min:60|max:36000',
+            'missing_backup_notification_days' => 'integer|min:0|max:365',
         ]);
         if ($validator->fails()) {
             return response()->json([
@@ -4885,6 +4889,8 @@ class DatabasesController extends Controller
                 'id',
                 'created_at',
                 'updated_at',
+                'last_execution_at',
+                'missing_backup_notification_sent_at',
             ])->fill([
                 'uuid' => new_public_id(),
                 'database_id' => $newDatabase->id,
diff --git a/app/Http/Controllers/Api/ServiceApplicationsController.php b/app/Http/Controllers/Api/ServiceApplicationsController.php
index e8446467de..5bf51bc027 100644
--- a/app/Http/Controllers/Api/ServiceApplicationsController.php
+++ b/app/Http/Controllers/Api/ServiceApplicationsController.php
@@ -9,6 +9,7 @@ use App\Actions\Service\UpdateServiceApplicationFromApi;
 use App\Http\Controllers\Controller;
 use App\Models\Service;
 use App\Models\ServiceApplication;
+use App\Support\ValidationPatterns;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
 use Illuminate\Support\Collection;
@@ -333,7 +334,7 @@ class ServiceApplicationsController extends Controller
         ];
 
         $validationRules = [
-            'url' => 'nullable|string',
+            'url' => ValidationPatterns::applicationDomainRules(),
             'noindex_domains' => 'sometimes|array|nullable',
             'noindex_domains.*' => 'string',
             'human_name' => 'nullable|string|max:255',
diff --git a/app/Http/Controllers/Api/ServicesController.php b/app/Http/Controllers/Api/ServicesController.php
index 9bfcfd8539..1a199c07ec 100644
--- a/app/Http/Controllers/Api/ServicesController.php
+++ b/app/Http/Controllers/Api/ServicesController.php
@@ -386,7 +386,7 @@ class ServicesController extends Controller
             'urls' => 'array|nullable',
             'urls.*' => 'array:name,url',
             'urls.*.name' => 'string|required',
-            'urls.*.url' => 'string|nullable',
+            'urls.*.url' => ValidationPatterns::applicationDomainRules(),
             'force_domain_override' => 'boolean',
             'is_container_label_escape_enabled' => 'boolean',
             'tags' => 'array|nullable',
@@ -602,7 +602,7 @@ class ServicesController extends Controller
                 'urls' => 'array|nullable',
                 'urls.*' => 'array:name,url',
                 'urls.*.name' => 'string|required',
-                'urls.*.url' => 'string|nullable',
+                'urls.*.url' => ValidationPatterns::applicationDomainRules(),
                 'force_domain_override' => 'boolean',
                 'is_container_label_escape_enabled' => 'boolean',
                 'tags' => 'array|nullable',
@@ -1187,7 +1187,7 @@ class ServicesController extends Controller
             'urls' => 'array|nullable',
             'urls.*' => 'array:name,url',
             'urls.*.name' => 'string|required',
-            'urls.*.url' => 'string|nullable',
+            'urls.*.url' => ValidationPatterns::applicationDomainRules(),
             'force_domain_override' => 'boolean',
             'is_container_label_escape_enabled' => 'boolean',
         ];
diff --git a/app/Http/Controllers/ProfileAvatarController.php b/app/Http/Controllers/ProfileAvatarController.php
index 2cf01400e8..f53cef7c51 100644
--- a/app/Http/Controllers/ProfileAvatarController.php
+++ b/app/Http/Controllers/ProfileAvatarController.php
@@ -14,7 +14,7 @@ class ProfileAvatarController extends Controller
 
         return response($contents, 200, [
             'Content-Type' => 'image/jpeg',
-            'Cache-Control' => 'private, max-age=300',
+            'Cache-Control' => 'private, max-age=31536000, immutable',
         ]);
     }
 }
diff --git a/app/Http/Controllers/ProjectIconController.php b/app/Http/Controllers/ProjectIconController.php
index fb7ebc8860..d99e9166d0 100644
--- a/app/Http/Controllers/ProjectIconController.php
+++ b/app/Http/Controllers/ProjectIconController.php
@@ -15,6 +15,9 @@ class ProjectIconController extends Controller
 
         abort_if($contents === null, 404);
 
-        return response($contents)->header('Content-Type', 'image/jpeg');
+        return response($contents, 200, [
+            'Content-Type' => 'image/jpeg',
+            'Cache-Control' => 'private, max-age=31536000, immutable',
+        ]);
     }
 }
diff --git a/app/Http/Controllers/Webhook/Github.php b/app/Http/Controllers/Webhook/Github.php
index 28e92dcd49..c4fdc5fd5c 100644
--- a/app/Http/Controllers/Webhook/Github.php
+++ b/app/Http/Controllers/Webhook/Github.php
@@ -83,7 +83,10 @@ class Github extends Controller
                 }
             }
             if ($x_github_event === 'pull_request') {
-                $applications = $this->manualWebhookApplications($applications->where('git_branch', $base_branch), $full_name);
+                if ($action !== 'closed') {
+                    $applications->where('git_branch', $base_branch);
+                }
+                $applications = $this->manualWebhookApplications($applications, $full_name);
                 if ($applications->isEmpty()) {
                     return response("Nothing to do. No applications found for repo $full_name and branch '$base_branch'.");
                 }
@@ -334,7 +337,10 @@ class Github extends Controller
                 }
             }
             if ($x_github_event === 'pull_request') {
-                $applications = $applications->where('git_branch', $base_branch)->get();
+                if ($action !== 'closed') {
+                    $applications->where('git_branch', $base_branch);
+                }
+                $applications = $applications->get();
                 if ($applications->isEmpty()) {
                     return response("Nothing to do. No applications found with branch '$base_branch'.");
                 }
diff --git a/app/Jobs/CheckMissingDatabaseBackupsJob.php b/app/Jobs/CheckMissingDatabaseBackupsJob.php
new file mode 100644
index 0000000000..06ba79a33f
--- /dev/null
+++ b/app/Jobs/CheckMissingDatabaseBackupsJob.php
@@ -0,0 +1,59 @@
+<?php
+
+namespace App\Jobs;
+
+use App\Models\ScheduledDatabaseBackup;
+use App\Notifications\Database\BackupMissing;
+use Illuminate\Bus\Queueable;
+use Illuminate\Contracts\Queue\ShouldBeEncrypted;
+use Illuminate\Contracts\Queue\ShouldBeUnique;
+use Illuminate\Contracts\Queue\ShouldQueue;
+use Illuminate\Foundation\Bus\Dispatchable;
+use Illuminate\Queue\InteractsWithQueue;
+use Illuminate\Queue\SerializesModels;
+use Illuminate\Support\Facades\Log;
+
+class CheckMissingDatabaseBackupsJob implements ShouldBeEncrypted, ShouldBeUnique, ShouldQueue
+{
+    use Dispatchable, InteractsWithQueue, Queueable, SerializesModels;
+
+    public function handle(): void
+    {
+        ScheduledDatabaseBackup::query()
+            ->with(['team', 'database', 'latest_log'])
+            ->where('enabled', true)
+            ->where('missing_backup_notification_days', '>', 0)
+            ->chunkById(100, function ($backups): void {
+                foreach ($backups as $backup) {
+                    $this->notifyIfMissing($backup);
+                }
+            });
+    }
+
+    private function notifyIfMissing(ScheduledDatabaseBackup $backup): void
+    {
+        $lastExecutionAt = $backup->last_execution_at ?? $backup->latest_log?->created_at;
+        $lastActivityAt = $lastExecutionAt ?? $backup->created_at;
+
+        if (! $lastActivityAt || $lastActivityAt->isAfter(now()->subDays($backup->missing_backup_notification_days))) {
+            return;
+        }
+
+        if ($backup->missing_backup_notification_sent_at?->greaterThanOrEqualTo($lastActivityAt)) {
+            return;
+        }
+
+        if (! $backup->team) {
+            Log::warning("Cannot send missing backup notification for backup {$backup->id}: team not found");
+
+            return;
+        }
+
+        if ($backup->team->getEnabledChannels('backup_failure') === []) {
+            return;
+        }
+
+        $backup->team->notify(new BackupMissing($backup, $lastExecutionAt));
+        $backup->forceFill(['missing_backup_notification_sent_at' => now()])->save();
+    }
+}
diff --git a/app/Jobs/StripeProcessJob.php b/app/Jobs/StripeProcessJob.php
index 6ddbfe145c..0f56476e25 100644
--- a/app/Jobs/StripeProcessJob.php
+++ b/app/Jobs/StripeProcessJob.php
@@ -74,7 +74,7 @@ class StripeProcessJob implements ShouldBeEncrypted, ShouldQueue
                         // send_internal_notification("User {$userId} is not an admin or owner of team {$team->id}, customerid: {$customerId}, subscriptionid: {$subscriptionId}.");
                         throw new \RuntimeException("User {$userId} is not an admin or owner of team {$team->id}, customerid: {$customerId}, subscriptionid: {$subscriptionId}.");
                     }
-                    Subscription::updateOrCreate(
+                    $subscription = Subscription::updateOrCreate(
                         ['team_id' => $teamId],
                         [
                             'stripe_subscription_id' => $subscriptionId,
@@ -83,6 +83,12 @@ class StripeProcessJob implements ShouldBeEncrypted, ShouldQueue
                             'stripe_past_due' => false,
                         ]
                     );
+                    logger()->info('Stripe subscription checkout completed.', [
+                        'team_id' => $team->id,
+                        'stripe_customer_id' => $customerId,
+                        'stripe_checkout_session_id' => data_get($data, 'id'),
+                        'stripe_subscription_id' => $subscription->stripe_subscription_id,
+                    ]);
                     break;
                 case 'invoice.paid':
                     $customerId = data_get($data, 'customer');
@@ -218,7 +224,7 @@ class StripeProcessJob implements ShouldBeEncrypted, ShouldQueue
                         // send_internal_notification("User {$userId} is not an admin or owner of team {$team->id}, customerid: {$customerId}.");
                         throw new \RuntimeException("User {$userId} is not an admin or owner of team {$team->id}, customerid: {$customerId}.");
                     }
-                    Subscription::updateOrCreate(
+                    $subscription = Subscription::firstOrCreate(
                         ['team_id' => $teamId],
                         [
                             'stripe_subscription_id' => $subscriptionId,
@@ -226,6 +232,11 @@ class StripeProcessJob implements ShouldBeEncrypted, ShouldQueue
                             'stripe_invoice_paid' => false,
                         ]
                     );
+                    if (! $subscription->stripe_subscription_id && $subscription->stripe_customer_id === $customerId) {
+                        $subscription->update(['stripe_subscription_id' => $subscriptionId]);
+                    } elseif ($subscription->stripe_customer_id !== $customerId) {
+                        throw new \RuntimeException("Stripe customer ID mismatch for team {$teamId}: stored {$subscription->stripe_customer_id}, event {$customerId}.");
+                    }
                     break;
                 case 'customer.subscription.updated':
                     $teamId = data_get($data, 'metadata.team_id');
diff --git a/app/Jobs/VolumeBackupJob.php b/app/Jobs/VolumeBackupJob.php
index b567a71b7f..0b13c66609 100644
--- a/app/Jobs/VolumeBackupJob.php
+++ b/app/Jobs/VolumeBackupJob.php
@@ -73,6 +73,7 @@ class VolumeBackupJob implements ShouldBeEncrypted, ShouldQueue
         $filename = str($this->backup->targetType())->lower().'-'.str($this->backup->targetName())->slug().'-'.Carbon::now()->timestamp.'.tar.gz';
         $backupLocation = $backupDirectory.'/'.$filename;
         $this->execution->update(['filename' => $backupLocation]);
+        $streamToS3 = $this->backup->save_s3 && $this->backup->disable_local_backup;
 
         try {
             $source = $this->backup->sourcePath();
@@ -86,11 +87,17 @@ class VolumeBackupJob implements ShouldBeEncrypted, ShouldQueue
 
             $compressorCommand = BackupCompression::compressorCommand($compressionCpuPercentage);
             $archiveScript = "compressor=\$({$compressorCommand}); tar -I \"\$compressor\" -cf - -C /volume .";
-            $archiveCommand = 'docker run --rm --name '.escapeshellarg($containerName)
-                .' -v '.escapeshellarg($source.':/volume:ro')
-                .' '.escapeshellarg($image)
-                .' sh -c '.escapeshellarg($archiveScript)
-                .' > '.escapeshellarg($backupLocation);
+            if ($streamToS3) {
+                $this->execution->update(['local_storage_deleted' => true]);
+                $archiveCommand = $this->streamToS3Command($archiveScript, $backupLocation, $source, $containerName, $image);
+                $this->execution->update(['s3_cleanup_pending' => true]);
+            } else {
+                $archiveCommand = 'docker run --rm --name '.escapeshellarg($containerName)
+                    .' -v '.escapeshellarg($source.':/volume:ro')
+                    .' '.escapeshellarg($image)
+                    .' sh -c '.escapeshellarg($archiveScript)
+                    .' > '.escapeshellarg($backupLocation);
+            }
 
             if ($this->backup->stop_during_backup) {
                 $containers = $this->containersUsingVolume($source, $server);
@@ -104,21 +111,23 @@ class VolumeBackupJob implements ShouldBeEncrypted, ShouldQueue
                 }
             }
 
-            instant_remote_process([
+            $archiveOutput = instant_remote_process(array_filter([
                 $verifySourceCommand,
-                'mkdir -p '.escapeshellarg($backupDirectory),
+                $streamToS3 ? null : 'mkdir -p '.escapeshellarg($backupDirectory),
                 $archiveCommand,
-            ], $server, timeout: $this->timeout, disableMultiplexing: true);
+            ]), $server, timeout: $this->timeout, disableMultiplexing: true);
             $this->execution->update([
                 'stop_container_ids' => null,
                 'stop_recovery_pending' => false,
             ]);
 
-            $size = (int) instant_remote_process(
-                ['du -b '.escapeshellarg($backupLocation).' | cut -f1'],
-                $server,
-                disableMultiplexing: true,
-            );
+            $size = $streamToS3
+                ? (int) str($archiveOutput)->trim()->afterLast("\n")->toString()
+                : (int) instant_remote_process(
+                    ['du -b '.escapeshellarg($backupLocation).' | cut -f1'],
+                    $server,
+                    disableMultiplexing: true,
+                );
 
             if ($size <= 0) {
                 throw new \RuntimeException('The storage backup archive is empty or was not created.');
@@ -127,9 +136,12 @@ class VolumeBackupJob implements ShouldBeEncrypted, ShouldQueue
             $warning = null;
             $s3Uploaded = null;
             $s3CleanupPending = false;
-            $localStorageDeleted = false;
+            $localStorageDeleted = $streamToS3;
 
-            if ($this->backup->save_s3) {
+            if ($streamToS3) {
+                $s3Uploaded = true;
+                $this->execution->update(['s3_cleanup_pending' => false]);
+            } elseif ($this->backup->save_s3) {
                 $s3CleanupPending = true;
                 $this->execution->update(['s3_cleanup_pending' => true]);
 
@@ -181,13 +193,23 @@ class VolumeBackupJob implements ShouldBeEncrypted, ShouldQueue
             }
         } catch (Throwable $exception) {
             $recoveryError = $this->recoverIncompleteBackup($this->execution);
-            $archiveDeleted = false;
+            $archiveDeleted = $streamToS3;
 
-            try {
-                deleteBackupsLocally($backupLocation, $server, throwError: true);
-                $archiveDeleted = true;
-            } catch (Throwable $cleanupException) {
-                $recoveryError .= ' Archive cleanup failed: '.$cleanupException->getMessage();
+            if ($streamToS3) {
+                $exception = new \RuntimeException(
+                    'S3-only streaming backup failed: '.$exception->getMessage()
+                    .'. The S3 destination may not support streaming uploads. Enable local backups to use the local archive upload method.',
+                    previous: $exception,
+                );
+            }
+
+            if (! $streamToS3) {
+                try {
+                    deleteBackupsLocally($backupLocation, $server, throwError: true);
+                    $archiveDeleted = true;
+                } catch (Throwable $cleanupException) {
+                    $recoveryError .= ' Archive cleanup failed: '.$cleanupException->getMessage();
+                }
             }
 
             $s3CleanupPending = $this->execution->fresh()->s3_cleanup_pending;
@@ -195,7 +217,9 @@ class VolumeBackupJob implements ShouldBeEncrypted, ShouldQueue
             $this->execution->update([
                 'status' => 'failed',
                 'message' => $exception->getMessage().$recoveryError,
-                'filename' => $archiveDeleted && ! $s3CleanupPending ? null : $backupLocation,
+                'filename' => $streamToS3
+                    ? ($s3CleanupPending ? $backupLocation : null)
+                    : ($archiveDeleted && ! $s3CleanupPending ? null : $backupLocation),
                 'local_storage_deleted' => $archiveDeleted,
             ]);
 
@@ -338,6 +362,34 @@ class VolumeBackupJob implements ShouldBeEncrypted, ShouldQueue
         }
     }
 
+    private function streamToS3Command(string $archiveScript, string $backupLocation, string $source, string $containerName, string $image): string
+    {
+        $s3 = $this->backup->s3;
+
+        if (! $s3) {
+            $this->backup->update(['save_s3' => false, 's3_storage_id' => null]);
+
+            throw new \RuntimeException('The selected S3 storage no longer exists. S3 backup has been disabled.');
+        }
+
+        $s3->testConnection(shouldSave: true);
+        $resolveOptions = collect(SafeWebhookUrl::minioClientResolveOptions($s3->endpoint, $s3->trustedInternalHosts()))
+            ->map(fn (string $option): string => '--resolve '.escapeshellarg($option))
+            ->implode(' ');
+        $resolveOptions = $resolveOptions === '' ? '' : ' '.$resolveOptions;
+        $destination = 'temporary/'.$s3->bucket.$backupLocation;
+        $streamScript = 'set -o pipefail; mc alias set'.$resolveOptions.' temporary '
+            .escapeshellarg($s3->endpoint).' '.escapeshellarg($s3->key).' '.escapeshellarg($s3->secret)
+            .' >/dev/null && ('.$archiveScript.' | mc pipe --quiet'.$resolveOptions.' '.escapeshellarg($destination).' >/dev/null)'
+            .' && mc stat --json'.$resolveOptions.' '.escapeshellarg($destination)
+            .' | sed -n '.escapeshellarg('s/.*"size":\([0-9][0-9]*\).*/\1/p');
+
+        return 'docker run --rm --name '.escapeshellarg($containerName)
+            .' -v '.escapeshellarg($source.':/volume:ro')
+            .' '.escapeshellarg($image)
+            .' sh -c '.escapeshellarg($streamScript);
+    }
+
     private function logCompressorInDevelopment(string $image, Server $server, int $compressionCpuPercentage): void
     {
         if (! isDev()) {
diff --git a/app/Livewire/Concerns/InteractsWithCloudflareDomainConnect.php b/app/Livewire/Concerns/InteractsWithCloudflareDomainConnect.php
index 44dba0d5e8..6ecea8e96f 100644
--- a/app/Livewire/Concerns/InteractsWithCloudflareDomainConnect.php
+++ b/app/Livewire/Concerns/InteractsWithCloudflareDomainConnect.php
@@ -209,19 +209,20 @@ trait InteractsWithCloudflareDomainConnect
             }
         }
 
-        // Prefer instance public IPv6 when the destination IP is IPv4-only (and vice versa).
-        try {
-            $settings = instanceSettings();
-            $publicV4 = data_get($settings, 'public_ipv4');
-            $publicV6 = data_get($settings, 'public_ipv6');
-            if ($ipv4 === null && is_string($publicV4) && filter_var($publicV4, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4)) {
-                $ipv4 = $publicV4;
+        if ($this->usesInstanceNetworkAddressesForDnsHints()) {
+            try {
+                $settings = instanceSettings();
+                $publicV4 = data_get($settings, 'public_ipv4');
+                $publicV6 = data_get($settings, 'public_ipv6');
+                if ($ipv4 === null && is_string($publicV4) && filter_var($publicV4, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4)) {
+                    $ipv4 = $publicV4;
+                }
+                if ($ipv6 === null && is_string($publicV6) && filter_var($publicV6, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6)) {
+                    $ipv6 = $publicV6;
+                }
+            } catch (\Throwable) {
+                //
             }
-            if ($ipv6 === null && is_string($publicV6) && filter_var($publicV6, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6)) {
-                $ipv6 = $publicV6;
-            }
-        } catch (\Throwable) {
-            //
         }
 
         return [$ipv4, $ipv6];
@@ -253,5 +254,7 @@ trait InteractsWithCloudflareDomainConnect
         return null;
     }
 
+    abstract protected function usesInstanceNetworkAddressesForDnsHints(): bool;
+
     abstract protected function authorizeUpdateForDomainConnect(): void;
 }
diff --git a/app/Livewire/Project/Application/Advanced.php b/app/Livewire/Project/Application/Advanced.php
index 45e284c5dc..a9e1c0be28 100644
--- a/app/Livewire/Project/Application/Advanced.php
+++ b/app/Livewire/Project/Application/Advanced.php
@@ -27,12 +27,6 @@ class Advanced extends Component
     #[Validate(['boolean'])]
     public bool $isGitShallowCloneEnabled = false;
 
-    #[Validate(['boolean'])]
-    public bool $isPreviewDeploymentsEnabled = false;
-
-    #[Validate(['boolean'])]
-    public bool $isPrDeploymentsPublicEnabled = false;
-
     #[Validate(['boolean'])]
     public bool $isAutoDeployEnabled = true;
 
@@ -107,8 +101,6 @@ class Advanced extends Component
             $this->application->settings->is_git_submodules_enabled = $this->isGitSubmodulesEnabled;
             $this->application->settings->is_git_lfs_enabled = $this->isGitLfsEnabled;
             $this->application->settings->is_git_shallow_clone_enabled = $this->isGitShallowCloneEnabled;
-            $this->application->settings->is_preview_deployments_enabled = $this->isPreviewDeploymentsEnabled;
-            $this->application->settings->is_pr_deployments_public_enabled = $this->isPrDeploymentsPublicEnabled;
             $this->application->settings->is_auto_deploy_enabled = $this->isAutoDeployEnabled;
             $this->application->settings->is_log_drain_enabled = $this->isLogDrainEnabled;
             $this->application->settings->is_gpu_enabled = $this->isGpuEnabled;
@@ -136,8 +128,6 @@ class Advanced extends Component
             $this->isGitSubmodulesEnabled = $this->application->settings->is_git_submodules_enabled;
             $this->isGitLfsEnabled = $this->application->settings->is_git_lfs_enabled;
             $this->isGitShallowCloneEnabled = $this->application->settings->is_git_shallow_clone_enabled ?? false;
-            $this->isPreviewDeploymentsEnabled = $this->application->settings->is_preview_deployments_enabled;
-            $this->isPrDeploymentsPublicEnabled = $this->application->settings->is_pr_deployments_public_enabled ?? false;
             $this->isAutoDeployEnabled = $this->application->settings->is_auto_deploy_enabled;
             $this->isGpuEnabled = $this->application->settings->is_gpu_enabled;
             $this->gpuDriver = $this->application->settings->gpu_driver;
diff --git a/app/Livewire/Project/Application/Domains.php b/app/Livewire/Project/Application/Domains.php
index d7797935f5..906cc147a0 100644
--- a/app/Livewire/Project/Application/Domains.php
+++ b/app/Livewire/Project/Application/Domains.php
@@ -150,7 +150,15 @@ class Domains extends Component
 
     public function refreshDomains(): void
     {
+        $editingRow = $this->editingIndex !== null ? ($this->domainRows[$this->editingIndex] ?? null) : null;
+
         $this->loadDomainState();
+
+        if ($editingRow !== null) {
+            $index = collect($this->domainRows)->search(fn (array $row): bool => $row['url'] === $editingRow['url']
+                && ($row['service'] ?? null) === ($editingRow['service'] ?? null));
+            $this->editingIndex = $index === false ? null : (int) $index;
+        }
     }
 
     public function pollDnsChecks(): void
@@ -227,7 +235,9 @@ class Domains extends Component
 
         $this->isCompose = $this->application->build_pack === 'dockercompose';
         $this->labelsAreWritable = $this->application->settings->is_container_label_readonly_enabled === false;
-        $this->redirect = $this->application->redirect ?? 'both';
+        if ($this->pendingAction !== 'redirect' || $this->isCompose) {
+            $this->redirect = $this->application->redirect ?? 'both';
+        }
         $this->isForceHttpsEnabled = $this->application->isForceHttpsEnabled();
 
         $settings = instanceSettings();
@@ -254,6 +264,9 @@ class Domains extends Component
         }
 
         $this->composeServices = [];
+        $pendingRedirect = $this->pendingRedirectService !== null
+            ? ($this->serviceRedirects[$this->serviceRedirectWireKey($this->pendingRedirectService)] ?? null)
+            : null;
         $this->serviceRedirects = [];
         if ($this->isCompose) {
             try {
@@ -290,7 +303,9 @@ class Domains extends Component
                 $serviceEntry = $domains[$serviceName] ?? null;
                 $storedRedirect = is_array($serviceEntry) ? ($serviceEntry['redirect'] ?? null) : null;
                 $this->serviceRedirects[$this->serviceRedirectWireKey($serviceName)] = $this->normalizeRedirect(
-                    is_string($storedRedirect) ? $storedRedirect : null
+                    $this->pendingAction === 'redirect' && $serviceName === $this->pendingRedirectService
+                        ? $pendingRedirect
+                        : (is_string($storedRedirect) ? $storedRedirect : null)
                 );
             }
         }
@@ -554,13 +569,6 @@ class Domains extends Component
             ];
         }
 
-        if ($this->application->settings?->is_static) {
-            return [
-                'internal_port' => 80,
-                'has_port_override' => false,
-            ];
-        }
-
         $composePort = dockerComposeServicePort($this->application->docker_compose_raw, $service);
         if ($composePort !== null) {
             return [
@@ -569,6 +577,20 @@ class Domains extends Component
             ];
         }
 
+        if ($this->isCompose && $service !== null) {
+            return [
+                'internal_port' => null,
+                'has_port_override' => false,
+            ];
+        }
+
+        if ($this->application->settings?->is_static) {
+            return [
+                'internal_port' => 80,
+                'has_port_override' => false,
+            ];
+        }
+
         $exposed = $this->application->ports_exposes_array;
         $defaultPort = isset($exposed[0]) && is_numeric($exposed[0]) && (int) $exposed[0] > 0
             ? (int) $exposed[0]
@@ -606,7 +628,7 @@ class Domains extends Component
         return $legacy !== '' && ctype_digit($legacy) ? (int) $legacy : null;
     }
 
-    protected function shouldConfirmPort(?int $port, ?int $currentPort = null): bool
+    protected function shouldConfirmPort(?int $port, ?int $currentPort = null, ?string $serviceName = null): bool
     {
         if ($this->forceUseUnknownPort || $port === null) {
             return false;
@@ -615,7 +637,7 @@ class Domains extends Component
             return false;
         }
 
-        return $this->application->portRequiresConfirmation($port);
+        return $this->application->portRequiresConfirmation($port, $serviceName);
     }
 
     protected function openPortWarning(?int $port, string $action): void
@@ -661,6 +683,11 @@ class Domains extends Component
         $this->authorize('update', $this->application);
     }
 
+    protected function usesInstanceNetworkAddressesForDnsHints(): bool
+    {
+        return $this->application->destination?->server?->id === 0;
+    }
+
     public function checkAllDns(): void
     {
         $this->authorize('update', $this->application);
@@ -961,7 +988,13 @@ class Domains extends Component
             return;
         }
 
+        $this->authorize('update', $this->application);
+        $wasRedirect = $this->pendingAction === 'redirect';
         $this->pendingAction = null;
+        $this->pendingRedirectService = null;
+        if ($wasRedirect) {
+            $this->refreshDomains();
+        }
     }
 
     public function addDomain(): void
@@ -1006,7 +1039,7 @@ class Domains extends Component
                 }
             }
 
-            if ($this->shouldConfirmPort($this->portFromParts($this->newDomainParts))) {
+            if ($this->shouldConfirmPort($this->portFromParts($this->newDomainParts), serviceName: $this->newDomainService)) {
                 $this->openPortWarning($this->portFromParts($this->newDomainParts), 'add');
 
                 return;
@@ -1403,7 +1436,7 @@ class Domains extends Component
                 return;
             }
 
-            if ($this->shouldConfirmPort($this->portFromParts($this->editingDomainParts), $this->currentRowPort($oldUrl))) {
+            if ($this->shouldConfirmPort($this->portFromParts($this->editingDomainParts), $this->currentRowPort($oldUrl), $service)) {
                 $this->openPortWarning($this->portFromParts($this->editingDomainParts), 'update');
 
                 return;
diff --git a/app/Livewire/Project/Application/General.php b/app/Livewire/Project/Application/General.php
index 8f0bb2385d..d25bbab374 100644
--- a/app/Livewire/Project/Application/General.php
+++ b/app/Livewire/Project/Application/General.php
@@ -145,7 +145,9 @@ class General extends Component
         return [
             'name' => ValidationPatterns::nameRules(),
             'description' => ValidationPatterns::descriptionRules(),
-            'fqdn' => ValidationPatterns::applicationDomainRules(),
+            'fqdn' => isset($this->application) && $this->fqdn === $this->application->fqdn
+                ? ['nullable']
+                : ValidationPatterns::applicationDomainRules(),
             'parsedServiceDomains.*.domain' => ValidationPatterns::applicationDomainRules(),
             'gitRepository' => 'required',
             'gitBranch' => ['required', 'string', new ValidGitBranch],
@@ -757,8 +759,11 @@ class General extends Component
             $oldDockerComposeLocation = $this->initialDockerComposeLocation;
             $oldBaseDirectory = $this->application->base_directory;
 
-            // Process FQDN with intermediate variable to avoid Collection/string confusion
-            $this->fqdn = ValidationPatterns::normalizeApplicationDomains($this->fqdn);
+            $fqdnChanged = $this->fqdn !== $this->application->fqdn;
+            if ($fqdnChanged) {
+                $this->fqdn = ValidationPatterns::normalizeApplicationDomains($this->fqdn);
+            }
+
             $warning = sslipDomainWarning($this->fqdn);
             if ($warning) {
                 $this->dispatch('warning', __('warning.sslipdomain'));
diff --git a/app/Livewire/Project/Application/PreviewDomains.php b/app/Livewire/Project/Application/PreviewDomains.php
index e6e9f5d60f..cba3f18b65 100644
--- a/app/Livewire/Project/Application/PreviewDomains.php
+++ b/app/Livewire/Project/Application/PreviewDomains.php
@@ -38,6 +38,7 @@ class PreviewDomains extends Component
 
     public function mount(): void
     {
+        $this->authorize('view', $this->preview->application);
         $this->refreshDomains();
         if ($this->preview->application->build_pack === 'dockercompose') {
             $this->newDomainService = $this->composeServices()[0] ?? null;
@@ -74,7 +75,7 @@ class PreviewDomains extends Component
 
             return;
         }
-        if ($this->shouldConfirmPort($this->portFromParts($this->newDomainParts))) {
+        if ($this->shouldConfirmPort($this->portFromParts($this->newDomainParts), serviceName: $this->newDomainService)) {
             $this->openPortWarning($this->portFromParts($this->newDomainParts), 'add');
 
             return;
@@ -94,7 +95,7 @@ class PreviewDomains extends Component
             ? ($this->composeServices()[0] ?? null)
             : null;
         $this->forceUseUnknownPort = false;
-        $this->dispatch('close-modal');
+        $this->dispatch('close-preview-domain-add', previewId: $this->preview->id);
 
         try {
             $server = $this->preview->application->destination?->server;
@@ -149,6 +150,7 @@ class PreviewDomains extends Component
 
     public function startEdit(int $index): void
     {
+        $this->authorize('update', $this->preview->application);
         if (! isset($this->domainRows[$index])) {
             return;
         }
@@ -159,7 +161,8 @@ class PreviewDomains extends Component
         if (filled($savedPort)) {
             $this->editingDomainParts['port'] = (string) $savedPort;
         }
-        $this->dispatch('open-preview-domain-edit');
+        $this->resetErrorBag('editingDomainParts.host');
+        $this->dispatch('open-preview-domain-edit', previewId: $this->preview->id);
     }
 
     public function updateDomain(): void
@@ -173,7 +176,7 @@ class PreviewDomains extends Component
             return;
         }
         $oldUrl = $this->domainRows[$this->editingIndex]['url'];
-        if ($this->shouldConfirmPort($this->portFromParts($this->editingDomainParts), $this->currentRowPort($oldUrl))) {
+        if ($this->shouldConfirmPort($this->portFromParts($this->editingDomainParts), $this->currentRowPort($oldUrl), $this->domainRows[$this->editingIndex]['service'])) {
             $this->openPortWarning($this->portFromParts($this->editingDomainParts), 'update');
 
             return;
@@ -193,7 +196,7 @@ class PreviewDomains extends Component
             return;
         }
         $this->forceUseUnknownPort = false;
-        $this->dispatch('close-preview-domain-edit');
+        $this->dispatch('close-preview-domain-edit', previewId: $this->preview->id);
         $this->dispatch('success', 'Domain updated.');
         $this->checkDomainDns($index);
     }
@@ -229,6 +232,12 @@ class PreviewDomains extends Component
         if (! isset($this->domainRows[$index])) {
             return;
         }
+        if ($this->editingIndex === $index) {
+            $this->editingIndex = null;
+            $this->dispatch('close-preview-domain-edit', previewId: $this->preview->id);
+        } elseif ($this->editingIndex !== null && $this->editingIndex > $index) {
+            $this->editingIndex--;
+        }
         unset($this->domainRows[$index]);
         $this->domainRows = array_values($this->domainRows);
         if (! $this->persistDomains()) {
@@ -268,6 +277,7 @@ class PreviewDomains extends Component
 
     public function pollDnsChecks(): void
     {
+        $this->authorize('view', $this->preview->application);
         $checkingRows = collect($this->domainRows)
             ->where('dns_status', 'checking')
             ->values();
@@ -321,6 +331,7 @@ class PreviewDomains extends Component
 
     private function refreshDomains(): void
     {
+        $editingRow = $this->editingIndex !== null ? ($this->domainRows[$this->editingIndex] ?? null) : null;
         $this->preview->refresh();
         $statuses = $this->preview->domain_dns_statuses ?? [];
         $rows = [];
@@ -336,6 +347,11 @@ class PreviewDomains extends Component
             }
         }
         $this->domainRows = $rows;
+        if ($editingRow !== null) {
+            $index = collect($this->domainRows)->search(fn (array $row): bool => $row['url'] === $editingRow['url']
+                && $row['service'] === $editingRow['service']);
+            $this->editingIndex = $index === false ? null : (int) $index;
+        }
     }
 
     private function persistDomains(): bool
@@ -349,13 +365,16 @@ class PreviewDomains extends Component
 
                 return false;
             }
-            $domains = collect($composeServices)
-                ->mapWithKeys(fn (string $service): array => [$service => ['domain' => '']])
-                ->all();
+            $existingDomains = json_decode($this->preview->docker_compose_domains ?: '[]', true) ?: [];
+            $domains = [];
+            foreach ($composeServices as $service) {
+                $domains[$service] = is_array($existingDomains[$service] ?? null) ? $existingDomains[$service] : [];
+                $domains[$service]['domain'] = '';
+            }
             $validRows = collect($this->domainRows)
                 ->filter(fn (array $row): bool => in_array($row['service'] ?? null, $composeServices, true));
             foreach ($validRows->groupBy('service') as $service => $rows) {
-                $domains[$service] = ['domain' => $rows->pluck('url')->implode(',')];
+                $domains[$service]['domain'] = $rows->pluck('url')->implode(',');
             }
             $this->preview->docker_compose_domains = json_encode($domains);
             $this->preview->fqdn = $validRows->pluck('url')->implode(',') ?: null;
@@ -440,10 +459,22 @@ class PreviewDomains extends Component
     {
         $status = $statuses[$this->statusKey($url, $service)] ?? [];
         $port = $this->effectiveDomainInternalPort($url, $service);
+        $redirect = 'both';
+        if ($this->preview->application->build_pack === 'dockercompose' && $service !== null) {
+            $usesPreviewRedirect = (int) $this->preview->application->compose_parsing_version >= 3;
+            $domains = json_decode(($usesPreviewRedirect
+                ? $this->preview->docker_compose_domains
+                : $this->preview->application->docker_compose_domains) ?: '[]', true) ?: [];
+            $storedRedirect = $usesPreviewRedirect
+                ? ($domains[$service]['redirect'] ?? null)
+                : data_get($domains, "$service.redirect");
+            $redirect = in_array($storedRedirect, ['www', 'non-www', 'both'], true) ? $storedRedirect : 'both';
+        }
 
         return [
             'url' => $url,
             'service' => $service,
+            'redirect' => $redirect,
             'internal_port' => $port['internal_port'],
             'has_port_override' => $port['has_port_override'],
             'dns_status' => $status['status'] ?? 'pending',
@@ -478,7 +509,7 @@ class PreviewDomains extends Component
         return $legacy !== '' && ctype_digit($legacy) ? (int) $legacy : null;
     }
 
-    private function shouldConfirmPort(?int $port, ?int $currentPort = null): bool
+    private function shouldConfirmPort(?int $port, ?int $currentPort = null, ?string $serviceName = null): bool
     {
         if ($this->forceUseUnknownPort || $port === null) {
             return false;
@@ -487,7 +518,7 @@ class PreviewDomains extends Component
             return false;
         }
 
-        return $this->preview->application->portRequiresConfirmation($port);
+        return $this->preview->application->portRequiresConfirmation($port, $serviceName);
     }
 
     private function openPortWarning(?int $port, string $action): void
@@ -522,13 +553,6 @@ class PreviewDomains extends Component
             ];
         }
 
-        if ($this->preview->application->settings?->is_static) {
-            return [
-                'internal_port' => 80,
-                'has_port_override' => false,
-            ];
-        }
-
         $composePort = dockerComposeServicePort($this->preview->application->docker_compose_raw, $service);
         if ($composePort !== null) {
             return [
@@ -537,6 +561,20 @@ class PreviewDomains extends Component
             ];
         }
 
+        if ($this->preview->application->build_pack === 'dockercompose' && $service !== null) {
+            return [
+                'internal_port' => null,
+                'has_port_override' => false,
+            ];
+        }
+
+        if ($this->preview->application->settings?->is_static) {
+            return [
+                'internal_port' => 80,
+                'has_port_override' => false,
+            ];
+        }
+
         $exposed = $this->preview->application->ports_exposes_array;
         $defaultPort = isset($exposed[0]) && is_numeric($exposed[0]) && (int) $exposed[0] > 0
             ? (int) $exposed[0]
diff --git a/app/Livewire/Project/Application/Previews.php b/app/Livewire/Project/Application/Previews.php
index fa0272bd64..acc7dc8608 100644
--- a/app/Livewire/Project/Application/Previews.php
+++ b/app/Livewire/Project/Application/Previews.php
@@ -19,6 +19,10 @@ class Previews extends Component
 
     public Application $application;
 
+    public bool $isPreviewDeploymentsEnabled = false;
+
+    public bool $isPrDeploymentsPublicEnabled = false;
+
     public string $deployment_uuid;
 
     public array $parameters;
@@ -41,11 +45,37 @@ class Previews extends Component
 
     public function mount()
     {
+        $this->isPreviewDeploymentsEnabled = $this->application->settings->is_preview_deployments_enabled;
+        $this->isPrDeploymentsPublicEnabled = $this->application->settings->is_pr_deployments_public_enabled ?? false;
         $this->pull_requests = collect();
         $this->parameters = get_route_parameters();
         $this->syncDockerTags();
     }
 
+    public function savePreviewSettings(): void
+    {
+        $this->authorize('update', $this->application);
+        $this->validate([
+            'isPreviewDeploymentsEnabled' => 'boolean',
+            'isPrDeploymentsPublicEnabled' => 'boolean',
+        ]);
+
+        $this->application->settings->is_preview_deployments_enabled = $this->isPreviewDeploymentsEnabled;
+        $this->application->settings->is_pr_deployments_public_enabled = $this->isPrDeploymentsPublicEnabled;
+        $this->application->settings->save();
+
+        $this->dispatch('success', 'Settings saved.');
+        $this->dispatch('configurationChanged');
+    }
+
+    public function togglePreviewDeployments(): void
+    {
+        $this->authorize('update', $this->application);
+
+        $this->isPreviewDeploymentsEnabled = ! $this->isPreviewDeploymentsEnabled;
+        $this->savePreviewSettings();
+    }
+
     private function syncDockerTags(): void
     {
         $this->previewDockerTags = [];
diff --git a/app/Livewire/Project/Database/BackupEdit.php b/app/Livewire/Project/Database/BackupEdit.php
index 28f7e02556..4a709d2b96 100644
--- a/app/Livewire/Project/Database/BackupEdit.php
+++ b/app/Livewire/Project/Database/BackupEdit.php
@@ -85,6 +85,9 @@ class BackupEdit extends Component
     #[Validate(['required', 'int', 'min:60', 'max:36000'])]
     public int|string $timeout = 3600;
 
+    #[Validate(['required', 'integer', 'min:0', 'max:365'])]
+    public int $missingBackupNotificationDays = 0;
+
     public function getListeners(): array
     {
         // Keep "Backup Now" in sync when the database starts/stops without a full page refresh.
@@ -152,6 +155,7 @@ class BackupEdit extends Component
             $this->backup->databases_to_backup = $this->databasesToBackup;
             $this->backup->dump_all = $this->dumpAll;
             $this->backup->timeout = $this->timeout;
+            $this->backup->missing_backup_notification_days = $this->missingBackupNotificationDays;
             $this->customValidate();
             $this->backup->save();
         } else {
@@ -170,6 +174,7 @@ class BackupEdit extends Component
             $this->databasesToBackup = $this->backup->databases_to_backup;
             $this->dumpAll = $this->backup->dump_all;
             $this->timeout = $this->backup->timeout;
+            $this->missingBackupNotificationDays = $this->backup->missing_backup_notification_days;
         }
     }
 
@@ -237,6 +242,14 @@ class BackupEdit extends Component
         try {
             $this->authorize('manageBackups', $this->backup->database);
 
+            $database = $this->backup->database->refresh();
+            $this->status = $database->status;
+            if ($database->id !== 0 && ! str($database->status)->startsWith('running')) {
+                $this->dispatch('error', 'The database must be running to start a backup.');
+
+                return;
+            }
+
             DatabaseBackupJob::dispatch($this->backup);
             $this->dispatch('success', 'Backup queued. It will be available in a few minutes.');
 
diff --git a/app/Livewire/Project/Database/BackupNow.php b/app/Livewire/Project/Database/BackupNow.php
index e4ed2a366c..8c83e33556 100644
--- a/app/Livewire/Project/Database/BackupNow.php
+++ b/app/Livewire/Project/Database/BackupNow.php
@@ -17,6 +17,13 @@ class BackupNow extends Component
         try {
             $this->authorize('manageBackups', $this->backup->database);
 
+            $database = $this->backup->database->refresh();
+            if ($database->id !== 0 && ! str($database->status)->startsWith('running')) {
+                $this->dispatch('error', 'The database must be running to start a backup.');
+
+                return;
+            }
+
             DatabaseBackupJob::dispatch($this->backup);
             $this->dispatch('success', 'Backup queued. It will be available in a few minutes.');
         } catch (\Throwable $e) {
diff --git a/app/Livewire/Project/Database/CreateScheduledBackup.php b/app/Livewire/Project/Database/CreateScheduledBackup.php
index b4236b215a..96d2ac7aaf 100644
--- a/app/Livewire/Project/Database/CreateScheduledBackup.php
+++ b/app/Livewire/Project/Database/CreateScheduledBackup.php
@@ -85,11 +85,10 @@ class CreateScheduledBackup extends Component
             $databaseBackup = ScheduledDatabaseBackup::create($payload);
             if ($database->getMorphClass() === ServiceDatabase::class) {
                 $service = $database->service;
-                $this->redirectRoute('project.service.database.backup.show', [
+                $this->redirectRoute('project.service.volume-backups.index', [
                     'project_uuid' => $service->project()->uuid,
                     'environment_uuid' => $service->environment->uuid,
                     'service_uuid' => $service->uuid,
-                    'stack_service_uuid' => $database->uuid,
                     'backup_uuid' => $databaseBackup->uuid,
                 ], navigate: true);
             } else {
diff --git a/app/Livewire/Project/Service/BackupExecutions.php b/app/Livewire/Project/Service/BackupExecutions.php
index 87f24fb1da..6d7fb97f68 100644
--- a/app/Livewire/Project/Service/BackupExecutions.php
+++ b/app/Livewire/Project/Service/BackupExecutions.php
@@ -9,16 +9,21 @@ use App\Models\ScheduledVolumeBackupExecution;
 use App\Models\Service;
 use App\Models\ServiceDatabase;
 use Illuminate\Contracts\View\View;
+use Illuminate\Database\Query\Builder;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Collection;
 use Livewire\Component;
+use Livewire\WithPagination;
 
 class BackupExecutions extends Component
 {
     use AuthorizesRequests;
+    use WithPagination;
 
     public Service $service;
 
+    public int $perPage = 10;
+
     public bool $executionModalOpen = false;
 
     public ?array $selectedExecution = null;
@@ -40,10 +45,18 @@ class BackupExecutions extends Component
         $this->authorize('view', $this->service);
     }
 
+    public function updatedPerPage(): void
+    {
+        $this->perPage = max(1, min(100, $this->perPage));
+        $this->resetPage('executionsPage');
+    }
+
     public function openExecution(string $executionUuid): void
     {
-        $this->selectedExecution = $this->executions()->firstWhere('uuid', $executionUuid);
-        abort_unless($this->selectedExecution, 404);
+        $this->authorize('view', $this->service);
+        $execution = $this->executionQuery($executionUuid)->first();
+        abort_unless($execution, 404);
+        $this->selectedExecution = $this->formatExecutions(collect([$execution]))->first();
         $this->executionModalOpen = true;
     }
 
@@ -55,70 +68,89 @@ class BackupExecutions extends Component
 
     public function render(): View
     {
+        $this->authorize('view', $this->service);
+        $executions = $this->executionQuery()->paginate($this->perPage, pageName: 'executionsPage');
+        if ($executions->currentPage() > $executions->lastPage()) {
+            $this->setPage($executions->lastPage(), 'executionsPage');
+            $executions = $this->executionQuery()->paginate($this->perPage, pageName: 'executionsPage');
+        }
+        $executions->setCollection($this->formatExecutions($executions->getCollection()));
+
         return view('livewire.project.service.backup-executions', [
-            'executions' => $this->executions(),
+            'executions' => $executions,
         ]);
     }
 
-    private function executions(): Collection
+    private function executionQuery(?string $uuid = null): Builder
     {
         $databaseScheduleIds = ScheduledDatabaseBackup::query()
             ->where('database_type', (new ServiceDatabase)->getMorphClass())
             ->whereHasMorph('database', [ServiceDatabase::class], fn ($query) => $query->where('service_id', $this->service->id))
-            ->pluck('id');
+            ->select('id');
+        $volumeScheduleIds = ScheduledVolumeBackup::query()
+            ->forService($this->service)
+            ->select('id');
 
         $databaseExecutions = ScheduledDatabaseBackupExecution::query()
-            ->with('scheduledDatabaseBackup.database')
+            ->select('id', 'uuid', 'created_at')
+            ->selectRaw("'database' as type")
             ->whereIn('scheduled_database_backup_id', $databaseScheduleIds)
-            ->latest()
-            ->limit(100)
-            ->get()
-            ->map(fn (ScheduledDatabaseBackupExecution $execution): array => [
-                'id' => 'database:'.$execution->id,
+            ->when($uuid !== null, fn ($query) => $query->where('uuid', $uuid));
+        $volumeExecutions = ScheduledVolumeBackupExecution::query()
+            ->select('id', 'uuid', 'created_at')
+            ->selectRaw("'storage' as type")
+            ->whereIn('scheduled_volume_backup_id', $volumeScheduleIds)
+            ->when($uuid !== null, fn ($query) => $query->where('uuid', $uuid));
+
+        return $databaseExecutions->toBase()
+            ->unionAll($volumeExecutions->toBase())
+            ->orderByDesc('created_at')
+            ->orderByDesc('id')
+            ->orderBy('type');
+    }
+
+    private function formatExecutions(Collection $rows): Collection
+    {
+        $databaseExecutions = ScheduledDatabaseBackupExecution::query()
+            ->with(['scheduledDatabaseBackup.database', 'scheduledDatabaseBackup.s3'])
+            ->whereIn('id', $rows->where('type', 'database')->pluck('id'))
+            ->get()->keyBy('id');
+        $volumeExecutions = ScheduledVolumeBackupExecution::query()
+            ->with(['scheduledVolumeBackup.backupable.resource', 's3'])
+            ->whereIn('id', $rows->where('type', 'storage')->pluck('id'))
+            ->get()->keyBy('id');
+
+        return $rows->map(function (object $row) use ($databaseExecutions, $volumeExecutions): array {
+            $isDatabase = $row->type === 'database';
+            $execution = $isDatabase ? $databaseExecutions->get($row->id) : $volumeExecutions->get($row->id);
+            $schedule = $isDatabase ? $execution->scheduledDatabaseBackup : $execution->scheduledVolumeBackup;
+            $storage = $isDatabase ? ($schedule->save_s3 ? $schedule->s3 : null) : $execution->s3;
+            if ($storage?->team_id !== currentTeam()->id) {
+                $storage = null;
+            }
+            $storageLabel = $storage ? $storage->name.' (bucket: '.$storage->bucket.')' : 'Unavailable';
+            if ($isDatabase && ! $schedule->save_s3) {
+                $storageLabel = 'Not configured';
+            } elseif (! $isDatabase && ! $execution->s3_storage_id && ! $execution->s3_uploaded && ! $execution->s3_storage_deleted) {
+                $storageLabel = 'No destination recorded';
+            }
+
+            return [
+                'id' => $row->type.':'.$execution->id,
                 'uuid' => $execution->uuid,
-                'target' => $execution->scheduledDatabaseBackup->database->human_name ?: $execution->scheduledDatabaseBackup->database->name,
-                'type' => 'Database',
-                'schedule' => $execution->scheduledDatabaseBackup->frequency,
+                'target' => $isDatabase ? ($schedule->database->human_name ?: $schedule->database->name) : $schedule->targetName(),
+                'type' => $isDatabase ? 'Database' : $schedule->targetType(),
+                'schedule' => $schedule->frequency,
+                's3_tooltip' => ($isDatabase ? 'Current schedule S3 storage: ' : 'S3 storage: ').$storageLabel,
                 'status' => $execution->status,
                 'started_at' => $execution->created_at,
                 'size' => $execution->size,
                 'message' => $execution->message,
                 'filename' => $execution->filename,
                 'download_url' => $execution->status === 'success' && ! $execution->local_storage_deleted
-                    ? route('download.backup', $execution->id)
+                    ? route($isDatabase ? 'download.backup' : 'download.volume-backup', $execution->id)
                     : null,
-            ]);
-
-        $volumeSchedules = ScheduledVolumeBackup::query()
-            ->with('backupable.resource')
-            ->forService($this->service)
-            ->get()
-            ->keyBy('id');
-        $volumeExecutions = ScheduledVolumeBackupExecution::query()
-            ->whereIn('scheduled_volume_backup_id', $volumeSchedules->keys())
-            ->latest()
-            ->limit(100)
-            ->get()
-            ->map(function (ScheduledVolumeBackupExecution $execution) use ($volumeSchedules): array {
-                $schedule = $volumeSchedules->get($execution->scheduled_volume_backup_id);
-
-                return [
-                    'id' => 'storage:'.$execution->id,
-                    'uuid' => $execution->uuid,
-                    'target' => $schedule->targetName(),
-                    'type' => $schedule->targetType(),
-                    'schedule' => $schedule->frequency,
-                    'status' => $execution->status,
-                    'started_at' => $execution->created_at,
-                    'size' => $execution->size,
-                    'message' => $execution->message,
-                    'filename' => $execution->filename,
-                    'download_url' => $execution->status === 'success' && ! $execution->local_storage_deleted
-                        ? route('download.volume-backup', $execution->id)
-                        : null,
-                ];
-            });
-
-        return $databaseExecutions->concat($volumeExecutions)->sortByDesc('started_at')->values();
+            ];
+        });
     }
 }
diff --git a/app/Livewire/Project/Service/Domains.php b/app/Livewire/Project/Service/Domains.php
index d5254e093a..b4f76d12d9 100644
--- a/app/Livewire/Project/Service/Domains.php
+++ b/app/Livewire/Project/Service/Domains.php
@@ -129,9 +129,17 @@ class Domains extends Component
 
     public function refreshDomains(): void
     {
+        $editingRow = $this->editingIndex !== null ? ($this->domainRows[$this->editingIndex] ?? null) : null;
+
         $this->service->refresh();
         $this->service->load(['applications', 'server']);
         $this->loadDomainState();
+
+        if ($editingRow !== null) {
+            $index = collect($this->domainRows)->search(fn (array $row): bool => $row['url'] === $editingRow['url']
+                && (int) $row['service_application_id'] === (int) $editingRow['service_application_id']);
+            $this->editingIndex = $index === false ? null : (int) $index;
+        }
     }
 
     public function pollDnsChecks(): void
@@ -239,9 +247,14 @@ class Domains extends Component
             ])
             ->all();
 
+        $pendingRedirect = $this->serviceRedirects[$this->pendingRedirectServiceApplicationId] ?? null;
         $this->serviceRedirects = [];
         foreach ($this->service->applications as $app) {
-            $this->serviceRedirects[$app->id] = $this->normalizeRedirect($app->redirect ?? null);
+            $this->serviceRedirects[$app->id] = $this->normalizeRedirect(
+                $this->pendingAction === 'redirect' && $app->id === $this->pendingRedirectServiceApplicationId
+                    ? $pendingRedirect
+                    : $app->redirect
+            );
         }
 
         if ($this->newServiceApplicationId === null && count($this->serviceApps) > 0) {
@@ -459,6 +472,11 @@ class Domains extends Component
         $this->authorize('update', $this->service);
     }
 
+    protected function usesInstanceNetworkAddressesForDnsHints(): bool
+    {
+        return $this->service->server?->id === 0;
+    }
+
     public function checkAllDns(): void
     {
         $this->authorize('update', $this->service);
@@ -919,6 +937,7 @@ class Domains extends Component
         }
 
         $toAdd = collect();
+        $portOverrides = $app->domain_port_overrides ?? [];
         foreach ($current as $url) {
             $counterpart = $this->wwwCounterpartUrl($url, forRedirectPairing: true);
             if ($counterpart === null) {
@@ -935,6 +954,11 @@ class Domains extends Component
                 continue;
             }
 
+            $port = $this->effectiveDomainInternalPort($url, $app);
+            if ($port['has_port_override']) {
+                $portOverrides[DomainPortOverrides::withoutPort($counterpart)] = $port['internal_port'];
+            }
+
             $knownHosts[$hostKey] = true;
             $toAdd->push($counterpart);
         }
@@ -943,12 +967,13 @@ class Domains extends Component
             return true;
         }
 
+        $app->domain_port_overrides = $portOverrides ?: null;
         $merged = $current->merge($toAdd)->unique()->values();
         $this->pendingAction = 'redirect';
         $this->pendingRedirectServiceApplicationId = $app->id;
 
-        // Skip DNS: pairing for redirects must still be configured even when DNS is not ready.
-        if (! $this->saveDomainListForApp($app, $merged)) {
+        // Counterparts inherit an existing port, so only domain conflicts need confirmation.
+        if (! $this->saveDomainListForApp($app, $merged, checkPorts: false)) {
             return false;
         }
 
@@ -975,11 +1000,24 @@ class Domains extends Component
             return;
         }
 
+        if ($this->pendingAction === 'redirect' && $this->pendingRedirectServiceApplicationId) {
+            $this->setServiceRedirect($this->pendingRedirectServiceApplicationId);
+
+            return;
+        }
+
         $this->addDomain();
     }
 
     public function cancelRemovePort(): void
     {
+        $this->authorize('update', $this->service);
+
+        if ($this->pendingAction === 'redirect' && $this->pendingRedirectServiceApplicationId) {
+            $app = $this->findServiceApp($this->pendingRedirectServiceApplicationId);
+            $this->serviceRedirects[$this->pendingRedirectServiceApplicationId] = $this->normalizeRedirect($app?->redirect);
+        }
+        $this->pendingRedirectServiceApplicationId = null;
         $this->showPortWarningModal = false;
         $this->forceSaveDomains = false;
         $this->forceRemovePort = false;
@@ -1416,6 +1454,7 @@ class Domains extends Component
         ServiceApplication $app,
         Collection $domains,
         bool $checkConflicts = true,
+        bool $checkPorts = true,
     ): bool {
         $domainString = $domains->filter()->unique()->implode(',');
         $domainString = $domainString === '' ? null : ValidationPatterns::normalizeApplicationDomains($domainString);
@@ -1442,7 +1481,7 @@ class Domains extends Component
             }
         }
 
-        if (! $this->forceRemovePort) {
+        if ($checkPorts && ! $this->forceRemovePort) {
             $requiredPort = $app->getRequiredPort();
             if ($requiredPort !== null && $domainString) {
                 $previousFqdn = $app->getOriginal('fqdn');
diff --git a/app/Livewire/Project/Service/Index.php b/app/Livewire/Project/Service/Index.php
index 7980e07056..3b8ca7af19 100644
--- a/app/Livewire/Project/Service/Index.php
+++ b/app/Livewire/Project/Service/Index.php
@@ -307,36 +307,48 @@ class Index extends Component
 
     public function instantSave()
     {
+        $this->authorize('update', $this->serviceDatabase);
         try {
-            $this->authorize('update', $this->serviceDatabase);
-            if ($this->isPublic && ! $this->publicPort) {
-                $this->dispatch('error', 'Public port is required.');
-                $this->isPublic = false;
-
-                return;
-            }
-            $this->syncDatabaseData(true);
-            if ($this->serviceDatabase->is_public) {
-                if (! str($this->serviceDatabase->status)->startsWith('running')) {
-                    $this->dispatch('error', 'Database must be started to be publicly accessible.');
+            if ($this->isPublic) {
+                if (! $this->publicPort) {
+                    $this->dispatch('error', 'Public port is required.');
                     $this->isPublic = false;
-                    $this->serviceDatabase->is_public = false;
 
                     return;
                 }
+                if (! str($this->serviceDatabase->status)->startsWith('running')) {
+                    $this->dispatch('error', 'Database must be started to be publicly accessible.');
+                    $this->isPublic = false;
+
+                    return;
+                }
+                $this->persistPublicAccess();
                 StartDatabaseProxy::run($this->serviceDatabase);
                 $this->db_url_public = $this->serviceDatabase->getServiceDatabaseUrl();
                 $this->dispatch('success', 'Database is now publicly accessible.');
             } else {
+                $this->persistPublicAccess();
                 StopDatabaseProxy::run($this->serviceDatabase);
                 $this->db_url_public = null;
                 $this->dispatch('success', 'Database is no longer publicly accessible.');
             }
         } catch (\Throwable $e) {
+            $this->isPublic = ! $this->isPublic;
+            $this->persistPublicAccess();
+
             return handleError($e, $this);
         }
     }
 
+    private function persistPublicAccess(): void
+    {
+        $this->serviceDatabase->update([
+            'is_public' => $this->isPublic,
+            'public_port' => $this->publicPort ?: null,
+            'public_port_timeout' => $this->publicPortTimeout ?: null,
+        ]);
+    }
+
     public function submitDatabase()
     {
         try {
diff --git a/app/Livewire/Project/Service/VolumeBackup/Index.php b/app/Livewire/Project/Service/VolumeBackup/Index.php
index e856d1373a..600b8b9047 100644
--- a/app/Livewire/Project/Service/VolumeBackup/Index.php
+++ b/app/Livewire/Project/Service/VolumeBackup/Index.php
@@ -11,6 +11,7 @@ use App\Models\ServiceDatabase;
 use Illuminate\Contracts\View\View;
 use Illuminate\Database\Eloquent\Collection;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Livewire\Attributes\Url;
 use Livewire\Component;
 
 class Index extends Component
@@ -23,6 +24,9 @@ class Index extends Component
 
     public string $search = '';
 
+    #[Url(as: 'backup_uuid', except: '')]
+    public string $backupUuid = '';
+
     public bool $scheduleModalOpen = false;
 
     public ?ScheduledDatabaseBackup $selectedDatabaseBackup = null;
@@ -38,6 +42,7 @@ class Index extends Component
         return [
             'refreshVolumeBackups' => '$refresh',
             'modalClosed' => 'closeScheduleModal',
+            "echo-private:team.{$teamId},ServiceChecked" => '$refresh',
             "echo-private:team.{$teamId},BackupCreated" => '$refresh',
         ];
     }
@@ -49,10 +54,14 @@ class Index extends Component
         $this->parameters = get_route_parameters();
         $this->search = request()->string('search')->toString();
 
+        if ($this->backupUuid !== '') {
+            $this->openSchedule($this->backupUuid);
+        }
     }
 
     public function openSchedule(string $backupUuid): void
     {
+        $this->authorize('update', $this->service);
         $this->loadSelectedSchedule($backupUuid);
         $this->s3s = currentTeam()->s3s;
         $this->scheduleModalOpen = true;
@@ -60,6 +69,7 @@ class Index extends Component
 
     public function closeScheduleModal(): void
     {
+        $this->backupUuid = '';
         $this->scheduleModalOpen = false;
         $this->selectedDatabaseBackup = null;
         $this->selectedVolumeBackup = null;
@@ -72,6 +82,12 @@ class Index extends Component
                 $this->loadSelectedSchedule($backupUuid);
                 abort_unless($this->selectedDatabaseBackup, 404);
                 $this->authorize('manageBackups', $this->selectedDatabaseBackup->database);
+                if (! str($this->selectedDatabaseBackup->database->status)->startsWith('running')) {
+                    $this->selectedDatabaseBackup = null;
+                    $this->dispatch('error', 'The database must be running to start a backup.');
+
+                    return;
+                }
                 DatabaseBackupJob::dispatch($this->selectedDatabaseBackup);
             } else {
                 abort_unless($type === 'storage', 404);
diff --git a/app/Livewire/Project/Shared/EnvironmentVariable/Show.php b/app/Livewire/Project/Shared/EnvironmentVariable/Show.php
index 8350cffa4c..d42184f650 100644
--- a/app/Livewire/Project/Shared/EnvironmentVariable/Show.php
+++ b/app/Livewire/Project/Shared/EnvironmentVariable/Show.php
@@ -299,6 +299,7 @@ class Show extends Component
             $this->syncData(true);
             $this->syncData(false);
             $this->dispatch('success', 'Environment variable updated.');
+            $this->dispatch('environment-variable-updated', envId: $this->env->id);
             $this->dispatch('envsUpdated');
             $this->dispatch('configurationChanged');
 
diff --git a/app/Livewire/Project/Shared/Storages/VolumeBackups.php b/app/Livewire/Project/Shared/Storages/VolumeBackups.php
index a10eb5ad03..a8e2d72df1 100644
--- a/app/Livewire/Project/Shared/Storages/VolumeBackups.php
+++ b/app/Livewire/Project/Shared/Storages/VolumeBackups.php
@@ -147,7 +147,11 @@ class VolumeBackups extends Component
         }
 
         $this->resetErrorBag('s3StorageId');
-        $this->backup?->update(['s3_storage_id' => $this->s3StorageId]);
+        if (! $this->validateSettings()) {
+            return;
+        }
+
+        $this->backup = $this->persistBackup($this->enabled);
         $this->dispatch('success', 'S3 storage updated.');
     }
 
@@ -163,11 +167,11 @@ class VolumeBackups extends Component
 
         $this->saveToS3 = ! $this->saveToS3;
         $this->disableLocalBackup = $this->saveToS3 && $this->disableLocalBackup;
-        $this->backup?->update([
-            'save_s3' => $this->saveToS3,
-            'disable_local_backup' => $this->disableLocalBackup,
-            's3_storage_id' => $this->s3StorageId,
-        ]);
+        if (! $this->validateSettings()) {
+            return;
+        }
+
+        $this->backup = $this->persistBackup($this->enabled);
         $this->dispatch('success', $this->saveToS3 ? 'S3 backups enabled.' : 'S3 backups disabled.');
     }
 
diff --git a/app/Livewire/Server/Resources.php b/app/Livewire/Server/Resources.php
index 9ea87161d8..5d0d2538bd 100644
--- a/app/Livewire/Server/Resources.php
+++ b/app/Livewire/Server/Resources.php
@@ -5,11 +5,29 @@ namespace App\Livewire\Server;
 use App\Models\Server;
 use App\Support\ValidationPatterns;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Illuminate\Pagination\LengthAwarePaginator;
 use Livewire\Component;
+use Livewire\WithPagination;
 
 class Resources extends Component
 {
     use AuthorizesRequests;
+    use WithPagination;
+
+    public int $perPage = 10;
+
+    public string $search = '';
+
+    public function updatedSearch(): void
+    {
+        $this->resetPage();
+    }
+
+    public function updatedPerPage(): void
+    {
+        $this->perPage = max(1, min(100, $this->perPage));
+        $this->resetPage();
+    }
 
     public ?Server $server = null;
 
@@ -93,6 +111,10 @@ class Resources extends Component
     public function loadManagedContainers()
     {
         try {
+            if ($this->activeTab !== 'managed') {
+                $this->search = '';
+                $this->resetPage();
+            }
             $this->activeTab = 'managed';
             $this->server->refresh();
         } catch (\Throwable $e) {
@@ -102,6 +124,10 @@ class Resources extends Component
 
     public function loadUnmanagedContainers()
     {
+        if ($this->activeTab !== 'unmanaged') {
+            $this->search = '';
+            $this->resetPage();
+        }
         $this->activeTab = 'unmanaged';
         try {
             $this->unmanagedContainers = $this->server->loadUnmanagedContainers()->toArray();
@@ -125,6 +151,29 @@ class Resources extends Component
 
     public function render()
     {
-        return view('livewire.server.resources');
+        $resources = $this->activeTab === 'managed'
+            ? $this->server->definedResources()->sortBy('name', SORT_NATURAL)
+            : collect($this->unmanagedContainers)->sortBy('Names', SORT_NATURAL);
+        $search = trim($this->search);
+        if ($search !== '') {
+            $nameKey = $this->activeTab === 'managed' ? 'name' : 'Names';
+            $resources = $resources->filter(fn ($resource) => str((string) data_get($resource, $nameKey))
+                ->contains($search, ignoreCase: true));
+        }
+        $this->perPage = max(1, min(100, $this->perPage));
+        $lastPage = max(1, (int) ceil($resources->count() / $this->perPage));
+        $page = max(1, min((int) $this->getPage(), $lastPage));
+        if ($page !== $this->getPage()) {
+            $this->setPage($page);
+        }
+
+        return view('livewire.server.resources', [
+            'resources' => new LengthAwarePaginator(
+                $resources->forPage($page, $this->perPage)->values(),
+                $resources->count(),
+                $this->perPage,
+                $page,
+            ),
+        ]);
     }
 }
diff --git a/app/Livewire/Server/Sentinel/Logs.php b/app/Livewire/Server/Sentinel/Logs.php
index 1190cd59a1..49739ac6dd 100644
--- a/app/Livewire/Server/Sentinel/Logs.php
+++ b/app/Livewire/Server/Sentinel/Logs.php
@@ -2,6 +2,7 @@
 
 namespace App\Livewire\Server\Sentinel;
 
+use App\Actions\Server\StartSentinel;
 use App\Models\Server;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\View\View;
@@ -29,6 +30,35 @@ class Logs extends Component
         $this->authorize('viewSentinel', $this->server);
     }
 
+    public function enableSentinel(): void
+    {
+        $this->authorize('manageSentinel', $this->server);
+
+        try {
+            $this->server->refresh();
+            if ($this->server->isBuildServer()) {
+                $this->dispatch('error', 'Sentinel cannot be enabled on build servers.');
+
+                return;
+            }
+            if ($this->server->isSwarm()) {
+                $this->dispatch('error', 'Sentinel cannot be enabled on Swarm servers.');
+
+                return;
+            }
+            if ($this->server->isSentinelEnabled()) {
+                return;
+            }
+
+            StartSentinel::run($this->server, true);
+            $this->server->refresh();
+            $this->dispatch('refreshServerShow');
+            $this->dispatch('success', 'Sentinel has been enabled.');
+        } catch (\Throwable $e) {
+            handleError($e, $this);
+        }
+    }
+
     public function render(): View
     {
         return view('livewire.server.sentinel.logs');
diff --git a/app/Livewire/Settings/Advanced.php b/app/Livewire/Settings/Advanced.php
index fd5ee616d9..45aff3f3c9 100644
--- a/app/Livewire/Settings/Advanced.php
+++ b/app/Livewire/Settings/Advanced.php
@@ -53,6 +53,8 @@ class Advanced extends Component
 
     public string $avatar_storage = 'local';
 
+    public ?string $image_cdn_url = null;
+
     public array $avatar_storage_options = [];
 
     public function rules()
@@ -71,6 +73,7 @@ class Advanced extends Component
             'webhook_allowed_internal_hosts' => 'nullable|string',
             'webhook_allow_localhost' => 'boolean',
             'domain_connect_private_key' => 'nullable|string',
+            'image_cdn_url' => 'nullable|url|max:255',
         ];
     }
 
@@ -97,6 +100,7 @@ class Advanced extends Component
         $this->avatar_storage = $this->settings->avatar_storage_type === 's3' && $this->settings->avatar_s3_storage_id
             ? 's3:'.$this->settings->avatar_s3_storage_id
             : 'local';
+        $this->image_cdn_url = $this->settings->image_cdn_url;
         $this->avatar_storage_options = [
             ['value' => 'local', 'label' => 'Local storage'],
             ...S3Storage::query()
@@ -210,6 +214,7 @@ class Advanced extends Component
             $this->settings->is_mcp_server_enabled = $this->is_mcp_server_enabled;
             $this->settings->webhook_allowed_internal_hosts = $webhookAllowedInternalHosts ?? $this->settings->webhook_allowed_internal_hosts ?? [];
             $this->settings->webhook_allow_localhost = $this->webhook_allow_localhost;
+            $this->settings->image_cdn_url = filled($this->image_cdn_url) ? rtrim($this->image_cdn_url, '/') : null;
             $this->saveAvatarStorageSetting();
             $this->settings->save();
             $this->dispatch('success', 'Settings updated!');
diff --git a/app/Livewire/Subscription/Index.php b/app/Livewire/Subscription/Index.php
index 022f6fdeed..31f2e9141d 100644
--- a/app/Livewire/Subscription/Index.php
+++ b/app/Livewire/Subscription/Index.php
@@ -2,8 +2,11 @@
 
 namespace App\Livewire\Subscription;
 
+use App\Actions\Stripe\UpdateSubscriptionQuantity;
+use App\Jobs\ServerLimitCheckJob;
 use App\Models\InstanceSettings;
 use App\Providers\RouteServiceProvider;
+use Illuminate\Support\Facades\Cache;
 use Livewire\Component;
 use Stripe\StripeClient;
 
@@ -49,12 +52,19 @@ class Index extends Component
         return redirect($session->url);
     }
 
-    public function getStripeStatus()
+    public function getStripeStatus(): mixed
     {
+        $team = currentTeam();
+        $user = auth()->user();
+        abort_unless($team && $user?->isAdminOfTeam($team->id), 403);
+
         try {
-            $subscription = currentTeam()->subscription;
+            $subscription = $team->subscription()->first();
+            if (! $subscription?->stripe_customer_id) {
+                return null;
+            }
             $stripe = app(StripeClient::class);
-            $customer = $stripe->customers->retrieve(currentTeam()->subscription->stripe_customer_id);
+            $customer = $stripe->customers->retrieve($subscription->stripe_customer_id);
             if ($customer) {
                 $subscriptions = $stripe->subscriptions->all(['customer' => $customer->id]);
                 $currentTeam = currentTeam()->id ?? null;
@@ -65,6 +75,26 @@ class Index extends Component
                         $subscription->update([
                             'stripe_subscription_id' => $foundSubscription->id,
                         ]);
+                        if ($status === 'active') {
+                            $subscription->update([
+                                'stripe_invoice_paid' => true,
+                                'stripe_past_due' => false,
+                                'stripe_plan_id' => data_get($foundSubscription, 'items.data.0.price.id'),
+                                'stripe_cancel_at_period_end' => data_get($foundSubscription, 'cancel_at_period_end', false),
+                            ]);
+                            if (str(data_get($foundSubscription, 'items.data.0.price.lookup_key'))->contains('dynamic')) {
+                                $quantity = max(
+                                    UpdateSubscriptionQuantity::MIN_SERVER_LIMIT,
+                                    min((int) data_get($foundSubscription, 'items.data.0.quantity', 2), UpdateSubscriptionQuantity::MAX_SERVER_LIMIT)
+                                );
+                                $team->update(['custom_server_limit' => $quantity]);
+                                ServerLimitCheckJob::dispatch($team);
+                            }
+                            $team->unsetRelation('subscription');
+                            Cache::forget('user:'.$user->id.':team:'.$team->id);
+
+                            return redirect()->route('subscription.show');
+                        }
                         if ($status === 'unpaid') {
                             $this->isUnpaid = true;
                         }
@@ -82,6 +112,8 @@ class Index extends Component
         } finally {
             $this->loading = false;
         }
+
+        return null;
     }
 
     public function render()
diff --git a/app/Livewire/Subscription/PricingPlans.php b/app/Livewire/Subscription/PricingPlans.php
index 65966aea5f..e53c5c677b 100644
--- a/app/Livewire/Subscription/PricingPlans.php
+++ b/app/Livewire/Subscription/PricingPlans.php
@@ -2,22 +2,28 @@
 
 namespace App\Livewire\Subscription;
 
-use Illuminate\Support\Facades\Auth;
+use App\Actions\Stripe\CreateCheckoutSession;
+use App\Exceptions\CheckoutUnavailableException;
 use Livewire\Component;
-use Stripe\Checkout\Session;
-use Stripe\Stripe;
+use RuntimeException;
+use Stripe\Exception\ApiErrorException;
 
 class PricingPlans extends Component
 {
-    public function subscribeStripe($type)
+    public function subscribeStripe(string $type): mixed
     {
-        if (currentTeam()->subscription?->stripe_invoice_paid) {
-            $this->dispatch('error', 'Team already has an active subscription.');
+        $team = currentTeam();
+        $user = auth()->user();
 
-            return;
+        if (! $team || ! $user?->isAdminOfTeam($team->id)) {
+            abort(403);
         }
 
-        Stripe::setApiKey(config('subscription.stripe_api_key'));
+        if ($team->subscription?->stripe_invoice_paid) {
+            $this->dispatch('error', 'Team already has an active subscription.');
+
+            return null;
+        }
 
         $priceId = match ($type) {
             'dynamic-monthly' => config('subscription.stripe_price_id_dynamic_monthly'),
@@ -28,48 +34,29 @@ class PricingPlans extends Component
         if (! $priceId) {
             $this->dispatch('error', 'Price ID not found! Please contact the administrator.');
 
-            return;
+            return null;
         }
-        $payload = [
-            'allow_promotion_codes' => true,
-            'billing_address_collection' => 'required',
-            'client_reference_id' => Auth::id().':'.currentTeam()->id,
-            'line_items' => [[
-                'price' => $priceId,
-                'adjustable_quantity' => [
-                    'enabled' => true,
-                    'minimum' => 2,
-                ],
-                'quantity' => 2,
-            ]],
-            'tax_id_collection' => [
-                'enabled' => true,
-            ],
-            'automatic_tax' => [
-                'enabled' => true,
-            ],
-            'subscription_data' => [
-                'metadata' => [
-                    'user_id' => Auth::id(),
-                    'team_id' => currentTeam()->id,
-                ],
-            ],
-            'payment_method_collection' => 'if_required',
-            'mode' => 'subscription',
-            'success_url' => route('dashboard', ['success' => true]),
-            'cancel_url' => route('subscription.index', ['cancelled' => true]),
-        ];
+        try {
+            $session = app(CreateCheckoutSession::class)->execute($team, $user, $priceId);
+        } catch (ApiErrorException $exception) {
+            report($exception);
+            $this->dispatch('error', 'Unable to confirm checkout with Stripe. Please try again shortly.');
 
-        $customer = currentTeam()->subscription?->stripe_customer_id ?? null;
-        if ($customer) {
-            $payload['customer'] = $customer;
-            $payload['customer_update'] = [
-                'name' => 'auto',
-            ];
-        } else {
-            $payload['customer_email'] = Auth::user()->email;
+            return null;
+        } catch (CheckoutUnavailableException $exception) {
+            $message = $exception->getMessage();
+            if ($exception->billingPortalUrl) {
+                $message .= ' <a href="'.e($exception->billingPortalUrl).'" target="_blank" rel="noopener noreferrer" class="underline">Open billing portal</a>';
+            }
+            $this->dispatch('error', $message);
+
+            return null;
+        } catch (RuntimeException $exception) {
+            report($exception);
+            $this->dispatch('error', 'Unable to start checkout. Please try again shortly.');
+
+            return null;
         }
-        $session = Session::create($payload);
 
         return redirect($session->url, 303);
     }
diff --git a/app/Models/Application.php b/app/Models/Application.php
index 7f7ce5ea1f..cec8d501ab 100644
--- a/app/Models/Application.php
+++ b/app/Models/Application.php
@@ -3,6 +3,7 @@
 namespace App\Models;
 
 use App\Enums\ApplicationDeploymentStatus;
+use App\Enums\BuildPackTypes;
 use App\Services\ConfigurationGenerator;
 use App\Services\DeploymentConfiguration\ApplicationConfigurationSnapshot;
 use App\Services\DeploymentConfiguration\ConfigurationDiff;
@@ -291,9 +292,11 @@ class Application extends BaseModel
                 if ($application->fqdn === '') {
                     $application->fqdn = null;
                 }
-                $normalized = DomainPortOverrides::normalize($application->fqdn, $application->domain_port_overrides);
-                $application->fqdn = $normalized['fqdn'];
-                $application->domain_port_overrides = $normalized['overrides'];
+                if ($application->build_pack !== BuildPackTypes::DOCKERCOMPOSE->value || filled($application->fqdn)) {
+                    $normalized = DomainPortOverrides::normalize($application->fqdn, $application->domain_port_overrides);
+                    $application->fqdn = $normalized['fqdn'];
+                    $application->domain_port_overrides = $normalized['overrides'];
+                }
                 $payload['fqdn'] = $application->fqdn;
                 $application->syncNoindexDomains();
             }
@@ -961,12 +964,16 @@ class Application extends BaseModel
     }
 
     /**
-     * Ports the container is expected to listen on: Ports Exposes plus ports already used by application domains.
+     * Ports declared by the selected Compose service, or exposed and previously used application ports.
      *
      * @return list<int>
      */
-    public function availableInternalPorts(): array
+    public function availableInternalPorts(?string $serviceName = null): array
     {
+        if ($this->build_pack === 'dockercompose') {
+            return dockerComposeServicePorts($this->docker_compose_raw, $serviceName);
+        }
+
         $ports = collect($this->settings?->is_static ? [80] : $this->ports_exposes_array)
             ->filter(fn (mixed $port): bool => is_numeric($port) && (int) $port > 0)
             ->map(fn (mixed $port): int => (int) $port);
@@ -991,13 +998,13 @@ class Application extends BaseModel
         return $ports->unique()->sort()->values()->all();
     }
 
-    public function portRequiresConfirmation(?int $port): bool
+    public function portRequiresConfirmation(?int $port, ?string $serviceName = null): bool
     {
         if ($port === null || $port <= 0) {
             return false;
         }
 
-        return ! in_array($port, $this->availableInternalPorts(), true);
+        return ! in_array($port, $this->availableInternalPorts($serviceName), true);
     }
 
     public function detectPortFromEnvironment(?bool $isPreview = false): ?int
diff --git a/app/Models/InstanceSettings.php b/app/Models/InstanceSettings.php
index eb01fa7ada..26aceec354 100644
--- a/app/Models/InstanceSettings.php
+++ b/app/Models/InstanceSettings.php
@@ -56,6 +56,7 @@ class InstanceSettings extends Model
         'webhook_allow_localhost',
         'avatar_storage_type',
         'avatar_s3_storage_id',
+        'image_cdn_url',
         'is_dashboard_force_https_enabled',
     ];
 
diff --git a/app/Models/ScheduledDatabaseBackup.php b/app/Models/ScheduledDatabaseBackup.php
index e41c793c86..7a26658e4f 100644
--- a/app/Models/ScheduledDatabaseBackup.php
+++ b/app/Models/ScheduledDatabaseBackup.php
@@ -14,6 +14,9 @@ class ScheduledDatabaseBackup extends BaseModel
             'dump_all' => 'boolean',
             'database_backup_retention_max_storage_locally' => 'float',
             'database_backup_retention_max_storage_s3' => 'float',
+            'missing_backup_notification_days' => 'integer',
+            'missing_backup_notification_sent_at' => 'datetime',
+            'last_execution_at' => 'datetime',
         ];
     }
 
@@ -37,6 +40,7 @@ class ScheduledDatabaseBackup extends BaseModel
         'database_backup_retention_max_storage_s3',
         'timeout',
         'disable_local_backup',
+        'missing_backup_notification_days',
     ];
 
     public static function ownedByCurrentTeam()
diff --git a/app/Models/ScheduledDatabaseBackupExecution.php b/app/Models/ScheduledDatabaseBackupExecution.php
index 8c5de1e8b1..1a479772cf 100644
--- a/app/Models/ScheduledDatabaseBackupExecution.php
+++ b/app/Models/ScheduledDatabaseBackupExecution.php
@@ -6,6 +6,13 @@ use Illuminate\Database\Eloquent\Relations\BelongsTo;
 
 class ScheduledDatabaseBackupExecution extends BaseModel
 {
+    protected static function booted(): void
+    {
+        static::created(function (ScheduledDatabaseBackupExecution $execution): void {
+            $execution->scheduledDatabaseBackup()->update(['last_execution_at' => $execution->created_at ?? now()]);
+        });
+    }
+
     protected $fillable = [
         'uuid',
         'scheduled_database_backup_id',
diff --git a/app/Models/ScheduledTaskExecution.php b/app/Models/ScheduledTaskExecution.php
index 1e26c7be3f..8f496fc1e6 100644
--- a/app/Models/ScheduledTaskExecution.php
+++ b/app/Models/ScheduledTaskExecution.php
@@ -39,7 +39,7 @@ class ScheduledTaskExecution extends BaseModel
             'started_at' => 'datetime',
             'finished_at' => 'datetime',
             'retry_count' => 'integer',
-            'duration' => 'decimal:2',
+            'duration' => 'float',
         ];
     }
 
diff --git a/app/Models/Service.php b/app/Models/Service.php
index 4308b78609..accbd9c30c 100644
--- a/app/Models/Service.php
+++ b/app/Models/Service.php
@@ -1477,7 +1477,10 @@ class Service extends BaseModel
     {
         try {
             $services = get_service_templates();
-            $serviceName = $this->service_type ?: str($this->name)->beforeLast('-')->value();
+            if (blank($this->service_type)) {
+                return null;
+            }
+            $serviceName = $this->service_type;
             $service = data_get($services, $serviceName, []);
             $port = data_get($service, 'port');
 
diff --git a/app/Models/ServiceApplication.php b/app/Models/ServiceApplication.php
index cf0faef5bd..cba18c1f23 100644
--- a/app/Models/ServiceApplication.php
+++ b/app/Models/ServiceApplication.php
@@ -201,7 +201,7 @@ class ServiceApplication extends BaseModel
     }
 
     /**
-     * Return the public URLs with their persisted internal port overrides.
+     * Return editable URLs with persisted overrides or legacy embedded ports.
      */
     protected function url(): Attribute
     {
@@ -220,7 +220,7 @@ class ServiceApplication extends BaseModel
                         $port = $overrides[$canonical] ?? null;
 
                         if ($port === null) {
-                            return $canonical;
+                            return $url;
                         }
 
                         $parts = DomainUrlParts::split($canonical);
@@ -366,7 +366,7 @@ class ServiceApplication extends BaseModel
             }
 
             $dockerCompose = Yaml::parse($dockerComposeRaw);
-            $serviceConfig = data_get($dockerCompose, "services.{$this->name}");
+            $serviceConfig = $dockerCompose['services'][$this->name] ?? null;
             if (! $serviceConfig) {
                 return $this->service->getRequiredPort();
             }
@@ -417,9 +417,21 @@ class ServiceApplication extends BaseModel
                 return $portFound;
             }
 
+            $composePort = firstDockerComposeServicePort($serviceConfig);
+            if ($composePort !== null) {
+                return $composePort;
+            }
+
             // HTTP-facing compose services that only declare SERVICE_URL/FQDN (no _PORT
             // suffix), such as WordPress, inherit the one-click template `# port:`.
             if ($declaresHttpUrl) {
+                if (blank($this->service->service_type)) {
+                    $savedPort = $this->getSavedLegacyRoutingPort($serviceConfig);
+                    if ($savedPort !== null) {
+                        return $savedPort;
+                    }
+                }
+
                 return $this->service->getRequiredPort();
             }
 
@@ -428,4 +440,52 @@ class ServiceApplication extends BaseModel
             return null;
         }
     }
+
+    /**
+     * Preserve only an unambiguous upstream from this legacy container's saved labels.
+     */
+    private function getSavedLegacyRoutingPort(array $serviceConfig): ?int
+    {
+        $savedCompose = Yaml::parse($this->service->docker_compose ?? '');
+        $savedService = $savedCompose['services'][$this->name] ?? null;
+        $image = $serviceConfig['image'] ?? null;
+        if (! is_string($image) || $image === '' || ($savedService['image'] ?? null) !== $image) {
+            return null;
+        }
+
+        $labels = $savedService['labels'] ?? [];
+        if (! is_array($labels)) {
+            return null;
+        }
+
+        $ports = [];
+        foreach ($labels as $key => $value) {
+            if (is_int($key)) {
+                if (! is_string($value)) {
+                    return null;
+                }
+                [$key, $value] = array_pad(explode('=', $value, 2), 2, null);
+            }
+
+            if (preg_match('/^traefik\.http\.services\.[^.]+\.loadbalancer\.server\.port$/', $key)) {
+                $port = $value;
+            } elseif (preg_match('/^caddy(?:_\d+)?\..*reverse_proxy$/', $key)) {
+                if (! is_string($value) || ! preg_match('/^\{\{upstreams ([0-9]+)\}\}$/', $value, $matches)) {
+                    return null;
+                }
+                $port = $matches[1];
+            } else {
+                continue;
+            }
+
+            if ((! is_string($port) && ! is_int($port)) || ! preg_match('/^[0-9]+$/', (string) $port) || (int) $port < 1 || (int) $port > 65535) {
+                return null;
+            }
+            $ports[] = (int) $port;
+        }
+
+        $ports = array_values(array_unique($ports));
+
+        return count($ports) === 1 ? $ports[0] : null;
+    }
 }
diff --git a/app/Notifications/ApiTokenExpiringNotification.php b/app/Notifications/ApiTokenExpiringNotification.php
index 40bd3ead0d..01f58af7ec 100644
--- a/app/Notifications/ApiTokenExpiringNotification.php
+++ b/app/Notifications/ApiTokenExpiringNotification.php
@@ -100,4 +100,16 @@ class ApiTokenExpiringNotification extends CustomEmailNotification
             color: SlackMessage::warningColor(),
         );
     }
+
+    public function toWebhook(): array
+    {
+        return [
+            'success' => false,
+            'message' => "API token '{$this->tokenName}' expires on {$this->expiresAt}. Rotate this token before it expires to avoid API outages.",
+            'event' => 'api_token_expiring',
+            'token_name' => $this->tokenName,
+            'expires_at' => $this->expiresAt,
+            'url' => $this->manageUrl,
+        ];
+    }
 }
diff --git a/app/Notifications/Channels/TelegramChannel.php b/app/Notifications/Channels/TelegramChannel.php
index a52feda087..118ad4269c 100644
--- a/app/Notifications/Channels/TelegramChannel.php
+++ b/app/Notifications/Channels/TelegramChannel.php
@@ -9,6 +9,7 @@ use App\Notifications\Application\RestartLimitReached;
 use App\Notifications\Application\StatusChanged;
 use App\Notifications\Container\ContainerRestarted;
 use App\Notifications\Database\BackupFailed;
+use App\Notifications\Database\BackupMissing;
 use App\Notifications\Database\BackupSuccess;
 use App\Notifications\ScheduledTask\TaskFailed;
 use App\Notifications\ScheduledTask\TaskSuccess;
@@ -40,7 +41,8 @@ class TelegramChannel
             RestartLimitReached::class => $settings->telegram_notifications_restart_limit_reached_thread_id,
 
             BackupSuccess::class => $settings->telegram_notifications_backup_success_thread_id,
-            BackupFailed::class => $settings->telegram_notifications_backup_failure_thread_id,
+            BackupFailed::class,
+            BackupMissing::class => $settings->telegram_notifications_backup_failure_thread_id,
 
             TaskSuccess::class => $settings->telegram_notifications_scheduled_task_success_thread_id,
             TaskFailed::class => $settings->telegram_notifications_scheduled_task_failure_thread_id,
diff --git a/app/Notifications/Database/BackupMissing.php b/app/Notifications/Database/BackupMissing.php
new file mode 100644
index 0000000000..d7f127ce3c
--- /dev/null
+++ b/app/Notifications/Database/BackupMissing.php
@@ -0,0 +1,83 @@
+<?php
+
+namespace App\Notifications\Database;
+
+use App\Models\ScheduledDatabaseBackup;
+use App\Notifications\CustomEmailNotification;
+use App\Notifications\Dto\DiscordMessage;
+use App\Notifications\Dto\PushoverMessage;
+use App\Notifications\Dto\SlackMessage;
+use Illuminate\Notifications\Messages\MailMessage;
+use Illuminate\Support\Carbon;
+
+class BackupMissing extends CustomEmailNotification
+{
+    public string $databaseName;
+
+    public function __construct(public ScheduledDatabaseBackup $backup, public ?Carbon $lastExecutionAt)
+    {
+        $this->onQueue('high');
+        $this->databaseName = $backup->database?->name ?? $backup->description ?? $backup->uuid;
+    }
+
+    public function via(object $notifiable): array
+    {
+        return $notifiable->getEnabledChannels('backup_failure');
+    }
+
+    public function toMail(): MailMessage
+    {
+        return (new MailMessage)
+            ->subject("Coolify: [ACTION REQUIRED] No recent backup for {$this->databaseName}")
+            ->view('emails.backup-missing', $this->messageData());
+    }
+
+    public function toDiscord(): DiscordMessage
+    {
+        return new DiscordMessage(
+            title: ':warning: Scheduled database backup missing',
+            description: $this->description(),
+            color: DiscordMessage::errorColor(),
+            isCritical: true,
+        );
+    }
+
+    public function toTelegram(): array
+    {
+        return ['message' => 'Coolify: '.$this->description()];
+    }
+
+    public function toPushover(): PushoverMessage
+    {
+        return new PushoverMessage(title: 'Scheduled database backup missing', level: 'error', message: $this->description());
+    }
+
+    public function toSlack(): SlackMessage
+    {
+        return new SlackMessage(title: 'Scheduled database backup missing', description: $this->description(), color: SlackMessage::errorColor());
+    }
+
+    public function toWebhook(): array
+    {
+        return array_merge($this->messageData(), [
+            'success' => false,
+            'message' => 'Scheduled database backup missing',
+            'event' => 'backup_missing',
+            'backup_uuid' => $this->backup->uuid,
+        ]);
+    }
+
+    private function description(): string
+    {
+        return "The enabled backup schedule for {$this->databaseName} has produced no executions in the last {$this->backup->missing_backup_notification_days} day(s).";
+    }
+
+    private function messageData(): array
+    {
+        return [
+            'database_name' => $this->databaseName,
+            'days' => $this->backup->missing_backup_notification_days,
+            'last_execution_at' => $this->lastExecutionAt?->toDateTimeString(),
+        ];
+    }
+}
diff --git a/app/Notifications/Internal/GeneralNotification.php b/app/Notifications/Internal/GeneralNotification.php
index 1d23672100..52e986ed6e 100644
--- a/app/Notifications/Internal/GeneralNotification.php
+++ b/app/Notifications/Internal/GeneralNotification.php
@@ -58,4 +58,14 @@ class GeneralNotification extends Notification implements ShouldQueue
             color: SlackMessage::infoColor(),
         );
     }
+
+    public function toWebhook(): array
+    {
+        return [
+            'success' => true,
+            'message' => $this->message,
+            'event' => 'general',
+            'url' => base_url(),
+        ];
+    }
 }
diff --git a/app/Notifications/Notification.php b/app/Notifications/Notification.php
deleted file mode 100644
index d37716a8b4..0000000000
--- a/app/Notifications/Notification.php
+++ /dev/null
@@ -1,22 +0,0 @@
-<?php
-
-namespace Illuminate\Notifications;
-
-use App\Notifications\Channels\SendsEmail;
-use App\Notifications\Dto\DiscordMessage;
-use App\Notifications\Dto\PushoverMessage;
-use App\Notifications\Dto\SlackMessage;
-use Illuminate\Notifications\Messages\MailMessage;
-
-interface Notification
-{
-    public function toMail(SendsEmail $notifiable): MailMessage;
-
-    public function toPushover(): PushoverMessage;
-
-    public function toDiscord(): DiscordMessage;
-
-    public function toSlack(): SlackMessage;
-
-    public function toTelegram();
-}
diff --git a/app/Notifications/Server/ForceDisabled.php b/app/Notifications/Server/ForceDisabled.php
index 4b56f5860b..2d2ebabaf0 100644
--- a/app/Notifications/Server/ForceDisabled.php
+++ b/app/Notifications/Server/ForceDisabled.php
@@ -74,4 +74,16 @@ class ForceDisabled extends CustomEmailNotification
             color: SlackMessage::errorColor()
         );
     }
+
+    public function toWebhook(): array
+    {
+        return [
+            'success' => false,
+            'message' => "Server ({$this->server->name}) disabled because it is not paid! All automations and integrations are stopped.",
+            'event' => 'server_force_disabled',
+            'server_name' => $this->server->name,
+            'server_uuid' => $this->server->uuid,
+            'url' => base_url().'/server/'.$this->server->uuid,
+        ];
+    }
 }
diff --git a/app/Notifications/Server/ForceEnabled.php b/app/Notifications/Server/ForceEnabled.php
index 36dad3c60f..61022d36b5 100644
--- a/app/Notifications/Server/ForceEnabled.php
+++ b/app/Notifications/Server/ForceEnabled.php
@@ -65,4 +65,16 @@ class ForceEnabled extends CustomEmailNotification
             color: SlackMessage::successColor()
         );
     }
+
+    public function toWebhook(): array
+    {
+        return [
+            'success' => true,
+            'message' => "Server ({$this->server->name}) enabled again!",
+            'event' => 'server_force_enabled',
+            'server_name' => $this->server->name,
+            'server_uuid' => $this->server->uuid,
+            'url' => base_url().'/server/'.$this->server->uuid,
+        ];
+    }
 }
diff --git a/app/Notifications/Server/HetznerDeletionFailed.php b/app/Notifications/Server/HetznerDeletionFailed.php
index bb452b054b..6c2712b68d 100644
--- a/app/Notifications/Server/HetznerDeletionFailed.php
+++ b/app/Notifications/Server/HetznerDeletionFailed.php
@@ -17,8 +17,7 @@ class HetznerDeletionFailed extends CustomEmailNotification
 
     public function via(object $notifiable): array
     {
-
-        return $notifiable->getEnabledChannels('hetzner_deletion_failed');
+        return $notifiable->getEnabledChannels('hetzner_deletion_failure');
     }
 
     public function toMail(): MailMessage
@@ -66,4 +65,16 @@ class HetznerDeletionFailed extends CustomEmailNotification
             color: SlackMessage::errorColor()
         );
     }
+
+    public function toWebhook(): array
+    {
+        return [
+            'success' => false,
+            'message' => "[ACTION REQUIRED] Failed to delete Hetzner server #{$this->hetznerServerId} from Hetzner Cloud. The server has been removed from Coolify, but may still exist in your Hetzner Cloud account.",
+            'event' => 'hetzner_deletion_failed',
+            'hetzner_server_id' => $this->hetznerServerId,
+            'error' => $this->errorMessage,
+            'url' => base_url().'/servers',
+        ];
+    }
 }
diff --git a/app/Notifications/SslExpirationNotification.php b/app/Notifications/SslExpirationNotification.php
index 023031ddd7..8d2a5e3952 100644
--- a/app/Notifications/SslExpirationNotification.php
+++ b/app/Notifications/SslExpirationNotification.php
@@ -117,4 +117,18 @@ class SslExpirationNotification extends CustomEmailNotification
             color: SlackMessage::warningColor()
         );
     }
+
+    public function toWebhook(): array
+    {
+        $resourceNames = $this->resources->pluck('name');
+
+        return [
+            'success' => false,
+            'message' => "SSL certificates have been renewed for: {$resourceNames->join(', ')}. These resources need to be redeployed manually for the new SSL certificates to take effect.",
+            'event' => 'ssl_certificate_renewal',
+            'resources' => $resourceNames->values()->all(),
+            'urls' => $this->urls,
+            'url' => base_url(),
+        ];
+    }
 }
diff --git a/app/Support/DatabaseBackupFileValidator.php b/app/Support/DatabaseBackupFileValidator.php
index 84e629fe1a..2c1de948ba 100644
--- a/app/Support/DatabaseBackupFileValidator.php
+++ b/app/Support/DatabaseBackupFileValidator.php
@@ -90,11 +90,8 @@ class DatabaseBackupFileValidator
 
     public static function containsPostgresqlProgramExecution(string $sql): bool
     {
-        $requireStatementBoundary = true;
-
         if (str_starts_with($sql, 'PGDMP')) {
-            $sql = preg_replace('/[\x00-\x08\x0B\x0C\x0E-\x1F]+/', "\n", $sql) ?? $sql;
-            $requireStatementBoundary = false;
+            return false;
         }
 
         $withoutComments = self::stripSqlComments($sql);
@@ -103,9 +100,7 @@ class DatabaseBackupFileValidator
             return true;
         }
 
-        $copyPrefix = $requireStatementBoundary ? '(?:^|;)\s*' : '\b';
-
-        return preg_match('/'.$copyPrefix.'copy\b[^;]{0,2000}\b(?:from|to)\s+program\b/i', $withoutComments) === 1;
+        return preg_match('/(?:^|;)\s*copy\b[^;]{0,2000}\b(?:from|to)\s+program\b/i', $withoutComments) === 1;
     }
 
     private static function extensionFor(string $name): ?string
diff --git a/app/View/Components/Forms/Button.php b/app/View/Components/Forms/Button.php
index 3e1600127e..f16fc3d953 100644
--- a/app/View/Components/Forms/Button.php
+++ b/app/View/Components/Forms/Button.php
@@ -23,6 +23,7 @@ class Button extends Component
         public mixed $canResource = null,
         public bool $autoDisable = true,
         public bool $isHighlighted = false,
+        public bool $isError = false,
         public ?string $tooltip = null,
     ) {
         // Handle authorization-based disabling
@@ -37,6 +38,8 @@ class Button extends Component
 
         if ($this->noStyle) {
             $this->defaultClass = '';
+        } elseif ($this->isError) {
+            $this->defaultClass .= ' button-error';
         }
     }
 
diff --git a/bootstrap/helpers/docker.php b/bootstrap/helpers/docker.php
index 84232a8d72..613a104e0e 100644
--- a/bootstrap/helpers/docker.php
+++ b/bootstrap/helpers/docker.php
@@ -607,6 +607,13 @@ function firstDockerComposeServicePort(mixed $service): ?int
         ->merge(data_get($service, 'ports', []));
 
     foreach ($portDefinitions as $definition) {
+        $protocol = is_array($definition)
+            ? data_get($definition, 'protocol', 'tcp')
+            : (str_contains((string) $definition, '/') ? str((string) $definition)->afterLast('/')->value() : 'tcp');
+        if ($protocol !== 'tcp') {
+            continue;
+        }
+
         $port = is_array($definition)
             ? data_get($definition, 'target')
             : str((string) $definition)->before('/')->afterLast(':')->value();
@@ -620,18 +627,29 @@ function firstDockerComposeServicePort(mixed $service): ?int
 }
 
 function dockerComposeServicePort(?string $compose, ?string $serviceName): ?int
+{
+    return dockerComposeServicePorts($compose, $serviceName)[0] ?? null;
+}
+
+function dockerComposeServicePorts(?string $compose, ?string $serviceName): array
 {
     if (blank($compose) || blank($serviceName)) {
-        return null;
+        return [];
     }
 
     try {
         $services = data_get(Yaml::parse($compose), 'services', []);
     } catch (Throwable) {
-        return null;
+        return [];
     }
 
-    return firstDockerComposeServicePort(is_array($services) ? ($services[$serviceName] ?? null) : null);
+    $service = is_array($services) ? ($services[$serviceName] ?? []) : [];
+
+    return collect(data_get($service, 'expose', []))
+        ->merge(data_get($service, 'ports', []))
+        ->map(fn ($definition) => firstDockerComposeServicePort(['expose' => [$definition]]))
+        ->filter(fn ($port) => $port !== null)
+        ->unique()->values()->all();
 }
 
 function fqdnLabelsForTraefik(string $uuid, Collection $domains, bool $is_force_https_enabled = false, $onlyPort = null, ?Collection $serviceLabels = null, ?bool $is_gzip_enabled = true, ?bool $is_stripprefix_enabled = true, ?string $service_name = null, bool $generate_unique_uuid = false, ?string $image = null, string $redirect_direction = 'both', bool $is_http_basic_auth_enabled = false, ?string $http_basic_auth_username = null, ?string $http_basic_auth_password = null, ?Collection $noindex_domains = null, bool $escape_redirect_replacement_for_compose = true, array $domainPortOverrides = [])
diff --git a/bootstrap/helpers/parsers.php b/bootstrap/helpers/parsers.php
index 03ebf5af7a..e50b852eca 100644
--- a/bootstrap/helpers/parsers.php
+++ b/bootstrap/helpers/parsers.php
@@ -1354,8 +1354,7 @@ function applicationParser(Application $resource, int $pull_request_id = 0, ?int
             $domainPortOverrides = $isPullRequest
                 ? ($previewForPorts?->domain_port_overrides ?? [])
                 : ($originalResource->domain_port_overrides ?? []);
-            $exposedPorts = $originalResource->settings->is_static ? [80] : $originalResource->ports_exposes_array;
-            $onlyPort = firstDockerComposeServicePort($service) ?? ($exposedPorts[0] ?? null);
+            $onlyPort = firstDockerComposeServicePort($service);
             if (! $use_network_mode && (! $shouldGenerateLabelsExactly || $server->proxyType() === ProxyTypes::TRAEFIK->value)) {
                 $serviceLabels = addTraefikDockerNetworkLabel($serviceLabels, $baseNetwork->first());
             }
@@ -1562,7 +1561,6 @@ function serviceParser(Service $resource): Collection
     $envComments = extractYamlEnvironmentComments($compose);
 
     $server = data_get($resource, 'server');
-    $allServices = get_service_templates();
 
     try {
         $yaml = Yaml::parse($compose);
@@ -1695,22 +1693,7 @@ function serviceParser(Service $resource): Collection
 
         $containerName = "$serviceName-{$resource->uuid}";
 
-        if ($serviceName === 'registry') {
-            $tempServiceName = 'docker-registry';
-        } else {
-            $tempServiceName = $serviceName;
-        }
-        if (str(data_get($service, 'image'))->contains('glitchtip')) {
-            $tempServiceName = 'glitchtip';
-        }
-        if ($serviceName === 'supabase-kong') {
-            $tempServiceName = 'supabase';
-        }
-        $serviceDefinition = data_get($allServices, $tempServiceName);
-        $predefinedPort = data_get($serviceDefinition, 'port');
-        if ($serviceName === 'plausible') {
-            $predefinedPort = '8000';
-        }
+        $predefinedPort = $resource->getRequiredPort();
 
         if ($migratedApp || $migratedDb) {
             // Use the already determined migrated service
@@ -2080,22 +2063,7 @@ function serviceParser(Service $resource): Collection
 
         $containerName = "$serviceName-{$resource->uuid}";
 
-        if ($serviceName === 'registry') {
-            $tempServiceName = 'docker-registry';
-        } else {
-            $tempServiceName = $serviceName;
-        }
-        if (str(data_get($service, 'image'))->contains('glitchtip')) {
-            $tempServiceName = 'glitchtip';
-        }
-        if ($serviceName === 'supabase-kong') {
-            $tempServiceName = 'supabase';
-        }
-        $serviceDefinition = data_get($allServices, $tempServiceName);
-        $predefinedPort = data_get($serviceDefinition, 'port');
-        if ($serviceName === 'plausible') {
-            $predefinedPort = '8000';
-        }
+        $predefinedPort = $resource->getRequiredPort();
 
         if ($migratedApp || $migratedDb) {
             // Use the already determined migrated service
@@ -2638,7 +2606,7 @@ function serviceParser(Service $resource): Collection
                 ? data_get($originalResource, 'redirect')
                 : 'both';
             $onlyPort = $originalResource instanceof ServiceApplication
-                ? ($originalResource->getRequiredPort() ?? $predefinedPort)
+                ? $originalResource->getRequiredPort()
                 : $predefinedPort;
             if (! $use_network_mode && (! $shouldGenerateLabelsExactly || $server->proxyType() === ProxyTypes::TRAEFIK->value)) {
                 $serviceLabels = addTraefikDockerNetworkLabel($serviceLabels, $baseNetwork->first());
@@ -2673,7 +2641,7 @@ function serviceParser(Service $resource): Collection
                             service_name: $serviceName,
                             image: $image,
                             onlyPort: $onlyPort,
-                            predefinedPort: $predefinedPort,
+                            predefinedPort: $onlyPort,
                             domainPortOverrides: $originalResource->domain_port_overrides ?? [],
                             noindex_domains: $noindexDomains,
                             redirect_direction: $redirectDirection
@@ -2706,7 +2674,7 @@ function serviceParser(Service $resource): Collection
                     service_name: $serviceName,
                     image: $image,
                     onlyPort: $onlyPort,
-                    predefinedPort: $predefinedPort,
+                    predefinedPort: $onlyPort,
                     domainPortOverrides: $originalResource->domain_port_overrides ?? [],
                     noindex_domains: $noindexDomains,
                     redirect_direction: $redirectDirection
diff --git a/bootstrap/helpers/shared.php b/bootstrap/helpers/shared.php
index f9bf44dffa..fbfbc9b566 100644
--- a/bootstrap/helpers/shared.php
+++ b/bootstrap/helpers/shared.php
@@ -860,7 +860,7 @@ function s3_image_url(?int $storageId, ?string $path, int $version): ?string
         return null;
     }
 
-    $baseUrl = config('constants.coolify.avatar_cdn_url') ?: $storage->awsUrl();
+    $baseUrl = instanceSettings()->image_cdn_url ?: $storage->awsUrl();
 
     return rtrim($baseUrl, '/').'/'.ltrim($path, '/').'?v='.$version;
 }
@@ -2486,7 +2486,6 @@ function parseDockerComposeFile(Service|Application $resource, bool $isNew = fal
             } catch (Exception $e) {
                 throw new RuntimeException($e->getMessage());
             }
-            $allServices = get_service_templates();
             $topLevelVolumes = collect(data_get($yaml, 'volumes', []));
             $topLevelNetworks = collect(data_get($yaml, 'networks', []));
             $topLevelConfigs = collect(data_get($yaml, 'configs', []));
@@ -2512,25 +2511,8 @@ function parseDockerComposeFile(Service|Application $resource, bool $isNew = fal
                 }
                 $topLevelVolumes = collect($tempTopLevelVolumes);
             }
-            $services = collect($services)->map(function ($service, $serviceName) use ($topLevelVolumes, $topLevelNetworks, $definedNetwork, $isNew, $generatedServiceFQDNS, $resource, $allServices, $envComments) {
-                // Workarounds for beta users.
-                if ($serviceName === 'registry') {
-                    $tempServiceName = 'docker-registry';
-                } else {
-                    $tempServiceName = $serviceName;
-                }
-                if (str(data_get($service, 'image'))->contains('glitchtip')) {
-                    $tempServiceName = 'glitchtip';
-                }
-                if ($serviceName === 'supabase-kong') {
-                    $tempServiceName = 'supabase';
-                }
-                $serviceDefinition = data_get($allServices, $tempServiceName);
-                $predefinedPort = data_get($serviceDefinition, 'port');
-                if ($serviceName === 'plausible') {
-                    $predefinedPort = '8000';
-                }
-                // End of workarounds for beta users.
+            $services = collect($services)->map(function ($service, $serviceName) use ($topLevelVolumes, $topLevelNetworks, $definedNetwork, $isNew, $generatedServiceFQDNS, $resource, $envComments) {
+                $predefinedPort = $resource->getRequiredPort();
                 $serviceVolumes = collect(data_get($service, 'volumes', []));
                 $servicePorts = collect(data_get($service, 'ports', []));
                 $serviceNetworks = collect(data_get($service, 'networks', []));
@@ -3107,7 +3089,7 @@ function parseDockerComposeFile(Service|Application $resource, bool $isNew = fal
                             ? ($savedService->domain_port_overrides ?? [])
                             : [];
                         $onlyPort = $savedService instanceof ServiceApplication
-                            ? ($savedService->getRequiredPort() ?? $predefinedPort)
+                            ? $savedService->getRequiredPort()
                             : $predefinedPort;
                         if ($shouldGenerateLabelsExactly) {
                             switch ($resource->server->proxyType()) {
@@ -3139,7 +3121,7 @@ function parseDockerComposeFile(Service|Application $resource, bool $isNew = fal
                                         service_name: $serviceName,
                                         image: data_get($service, 'image'),
                                         onlyPort: $onlyPort,
-                                        predefinedPort: $predefinedPort,
+                                        predefinedPort: $onlyPort,
                                         noindex_domains: $noindexDomains,
                                         redirect_direction: $redirectDirection,
                                         domainPortOverrides: $domainPortOverrides,
@@ -3172,7 +3154,7 @@ function parseDockerComposeFile(Service|Application $resource, bool $isNew = fal
                                 service_name: $serviceName,
                                 image: data_get($service, 'image'),
                                 onlyPort: $onlyPort,
-                                predefinedPort: $predefinedPort,
+                                predefinedPort: $onlyPort,
                                 noindex_domains: $noindexDomains,
                                 redirect_direction: $redirectDirection,
                                 domainPortOverrides: $domainPortOverrides,
@@ -3915,8 +3897,7 @@ function parseDockerComposeFile(Service|Application $resource, bool $isNew = fal
                         $domainPortOverrides = $pull_request_id === 0
                             ? ($resource->domain_port_overrides ?? [])
                             : ($preview?->domain_port_overrides ?? []);
-                        $exposedPorts = $resource->settings->is_static ? [80] : $resource->ports_exposes_array;
-                        $onlyPort = firstDockerComposeServicePort($service) ?? ($exposedPorts[0] ?? null);
+                        $onlyPort = firstDockerComposeServicePort($service);
                         if ($shouldGenerateLabelsExactly) {
                             switch ($server->proxyType()) {
                                 case ProxyTypes::TRAEFIK->value:
diff --git a/bootstrap/helpers/sudo.php b/bootstrap/helpers/sudo.php
index 397efc387c..98dbe3af7a 100644
--- a/bootstrap/helpers/sudo.php
+++ b/bootstrap/helpers/sudo.php
@@ -59,13 +59,18 @@ function parseCommandsByLineForSudo(Collection $commands, Server $server): array
             return $line;
         }
 
+        // Negation belongs to the shell, before the elevated command.
+        if (preg_match('/^\s*!\s+/', $line)) {
+            return preg_replace('/^(\s*(?:!\s+)+)/', '$1sudo ', $line);
+        }
+
         // Check all keywords with word boundary matching
         // Match keyword followed by space, semicolon, or end of line
         foreach ($bashKeywords as $keyword) {
             if (preg_match('/^'.preg_quote($keyword, '/').'(\s|;|$)/', $trimmedLine)) {
-                // Special handling for 'if' - insert sudo after 'if '
+                // Keep any shell negation before sudo in the condition.
                 if ($keyword === 'if') {
-                    return preg_replace('/^(\s*)if\s+/', '$1if sudo ', $line);
+                    return preg_replace('/^(\s*if\s+(?:!\s+)*)/', '$1sudo ', $line);
                 }
 
                 return $line;
diff --git a/config/constants.php b/config/constants.php
index 7ad0c4594f..7e649668d8 100644
--- a/config/constants.php
+++ b/config/constants.php
@@ -2,9 +2,9 @@
 
 return [
     'coolify' => [
-        'version' => env('COOLIFY_VERSION') ?: '4.3.17',
+        'version' => env('COOLIFY_VERSION') ?: '4.3.19',
         'helper_version' => '1.0.16',
-        'realtime_version' => '1.0.18',
+        'realtime_version' => '1.0.19',
         'railpack_version' => '0.23.0',
         'self_hosted' => env('SELF_HOSTED', true),
         'autoupdate' => env('AUTOUPDATE'),
@@ -14,7 +14,6 @@ return [
         'realtime_image' => env('REALTIME_IMAGE', env('REGISTRY_URL', 'docker.io').'/coollabsio/coolify-realtime'),
         'is_windows_docker_desktop' => env('IS_WINDOWS_DOCKER_DESKTOP', false),
         'cdn_url' => env('CDN_URL', 'https://cdn.coollabs.io'),
-        'avatar_cdn_url' => env('AVATAR_CDN_URL'),
         'versions_url' => env('VERSIONS_URL', env('CDN_URL', 'https://cdn.coollabs.io').'/coolify/versions.json'),
         'upgrade_script_url' => env('UPGRADE_SCRIPT_URL', env('CDN_URL', 'https://cdn.coollabs.io').'/coolify/upgrade.sh'),
         'releases_url' => env('RELEASES_URL', 'https://cdn.coollabs.io/coolify/releases.json'),
diff --git a/database/migrations/2026_08_20_150000_add_missing_backup_notification_fields_to_scheduled_database_backups_table.php b/database/migrations/2026_08_20_150000_add_missing_backup_notification_fields_to_scheduled_database_backups_table.php
new file mode 100644
index 0000000000..fe7c1e6292
--- /dev/null
+++ b/database/migrations/2026_08_20_150000_add_missing_backup_notification_fields_to_scheduled_database_backups_table.php
@@ -0,0 +1,28 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('scheduled_database_backups', function (Blueprint $table) {
+            $table->unsignedInteger('missing_backup_notification_days')->default(0);
+            $table->timestamp('missing_backup_notification_sent_at')->nullable();
+            $table->timestamp('last_execution_at')->nullable();
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('scheduled_database_backups', function (Blueprint $table) {
+            $table->dropColumn([
+                'missing_backup_notification_days',
+                'missing_backup_notification_sent_at',
+                'last_execution_at',
+            ]);
+        });
+    }
+};
diff --git a/database/migrations/2026_09_04_191011_add_image_cdn_url_to_instance_settings_table.php b/database/migrations/2026_09_04_191011_add_image_cdn_url_to_instance_settings_table.php
new file mode 100644
index 0000000000..1c898dd5da
--- /dev/null
+++ b/database/migrations/2026_09_04_191011_add_image_cdn_url_to_instance_settings_table.php
@@ -0,0 +1,28 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::table('instance_settings', function (Blueprint $table) {
+            $table->string('image_cdn_url')->nullable();
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('instance_settings', function (Blueprint $table) {
+            $table->dropColumn('image_cdn_url');
+        });
+    }
+};
diff --git a/database/seeders/TeamSeeder.php b/database/seeders/TeamSeeder.php
index 67c5ec4897..08426044c6 100644
--- a/database/seeders/TeamSeeder.php
+++ b/database/seeders/TeamSeeder.php
@@ -10,14 +10,14 @@ class TeamSeeder extends Seeder
 {
     public function run(): void
     {
-        $normal_user_in_root_team = User::find(1);
+        $normal_user_in_root_team = User::where('email', 'test2@example.com')->firstOrFail();
         $root_user_personal_team = Team::find(0);
         $root_user_personal_team->description = 'The root team';
         $root_user_personal_team->save();
 
         $normal_user_in_root_team->teams()->attach($root_user_personal_team);
-        $normal_user_not_in_root_team = User::find(2);
-        $normal_user_in_root_team_personal_team = Team::find(1);
+        $normal_user_not_in_root_team = User::where('email', 'test3@example.com')->firstOrFail();
+        $normal_user_in_root_team_personal_team = $normal_user_in_root_team->teams()->where('personal_team', true)->wherePivot('role', 'owner')->firstOrFail();
         $normal_user_not_in_root_team->teams()->attach($normal_user_in_root_team_personal_team, ['role' => 'admin']);
     }
 }
diff --git a/database/seeders/UserSeeder.php b/database/seeders/UserSeeder.php
index 2ac615cc01..9f237dc3b5 100644
--- a/database/seeders/UserSeeder.php
+++ b/database/seeders/UserSeeder.php
@@ -15,14 +15,13 @@ class UserSeeder extends Seeder
             'email' => 'test@example.com',
         ]);
         User::factory()->create([
-            'id' => 1,
             'name' => 'Normal User (but in root team)',
             'email' => 'test2@example.com',
         ]);
         User::factory()->create([
-            'id' => 2,
             'name' => 'Normal User (not in root team)',
             'email' => 'test3@example.com',
         ]);
+
     }
 }
diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml
index ebf12379d5..d611fc69f7 100644
--- a/docker-compose.prod.yml
+++ b/docker-compose.prod.yml
@@ -62,7 +62,7 @@ services:
       retries: 10
       timeout: 2s
   soketi:
-    image: '${REGISTRY_URL:-docker.io}/coollabsio/coolify-realtime:1.0.18'
+    image: '${REGISTRY_URL:-docker.io}/coollabsio/coolify-realtime:1.0.19'
     ports:
       - "${SOKETI_PORT:-6001}:6001"
       - "6002:6002"
diff --git a/docker-compose.windows.yml b/docker-compose.windows.yml
index cc266e5562..6a52a0126a 100644
--- a/docker-compose.windows.yml
+++ b/docker-compose.windows.yml
@@ -97,7 +97,7 @@ services:
       retries: 10
       timeout: 2s
   soketi:
-    image: 'ghcr.io/coollabsio/coolify-realtime:1.0.18'
+    image: 'ghcr.io/coollabsio/coolify-realtime:1.0.19'
     pull_policy: always
     container_name: coolify-realtime
     restart: always
diff --git a/docker/coolify-realtime/terminal-server.js b/docker/coolify-realtime/terminal-server.js
index b72574c8d0..09f5bd5e12 100755
--- a/docker/coolify-realtime/terminal-server.js
+++ b/docker/coolify-realtime/terminal-server.js
@@ -8,6 +8,7 @@ import {
     extractSshArgs,
     extractTargetHost,
     extractTimeout,
+    getTerminalProcessEnv,
     getTerminalSessionTimeout,
     isAuthorizedTargetHost,
     sanitizeSshArgs,
@@ -401,7 +402,7 @@ async function handleCommand(ws, command, userId) {
         cols: 80,
         rows: 30,
         cwd: process.env.HOME,
-        env: {},
+        env: getTerminalProcessEnv(),
     };
 
     // NOTE: - Initiates a process within the Terminal container
diff --git a/docker/coolify-realtime/terminal-utils.js b/docker/coolify-realtime/terminal-utils.js
index 4e86dc1f73..0d13dc18f1 100644
--- a/docker/coolify-realtime/terminal-utils.js
+++ b/docker/coolify-realtime/terminal-utils.js
@@ -1,5 +1,13 @@
 export const MAX_TERMINAL_SESSION_TIMEOUT_SECONDS = 8 * 60 * 60;
 
+const DEFAULT_TERMINAL_PATH = '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin';
+
+export function getTerminalProcessEnv(environment = process.env) {
+    return {
+        PATH: environment.PATH || DEFAULT_TERMINAL_PATH,
+    };
+}
+
 export function getTerminalSessionTimeout() {
     return MAX_TERMINAL_SESSION_TIMEOUT_SECONDS;
 }
diff --git a/docker/coolify-realtime/terminal-utils.test.js b/docker/coolify-realtime/terminal-utils.test.js
index 5ca0be8304..21625eece4 100644
--- a/docker/coolify-realtime/terminal-utils.test.js
+++ b/docker/coolify-realtime/terminal-utils.test.js
@@ -4,6 +4,7 @@ import {
     MAX_TERMINAL_SESSION_TIMEOUT_SECONDS,
     extractSshArgs,
     extractTargetHost,
+    getTerminalProcessEnv,
     getTerminalSessionTimeout,
     isAuthorizedTargetHost,
     normalizeHostForAuthorization,
@@ -11,6 +12,32 @@ import {
     validateSshArgs,
 } from './terminal-utils.js';
 
+test('getTerminalProcessEnv preserves the PATH needed by SSH proxy commands', () => {
+    assert.deepEqual(getTerminalProcessEnv({
+        PATH: '/usr/local/bin:/usr/bin:/bin',
+        APP_KEY: 'must-not-be-inherited',
+    }), {
+        PATH: '/usr/local/bin:/usr/bin:/bin',
+    });
+});
+
+test('getTerminalProcessEnv uses the default PATH when PATH is absent', () => {
+    assert.deepEqual(getTerminalProcessEnv({
+        APP_KEY: 'must-not-be-inherited',
+    }), {
+        PATH: '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin',
+    });
+});
+
+test('getTerminalProcessEnv uses the default PATH when PATH is empty', () => {
+    assert.deepEqual(getTerminalProcessEnv({
+        PATH: '',
+        APP_KEY: 'must-not-be-inherited',
+    }), {
+        PATH: '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin',
+    });
+});
+
 test('extractTargetHost normalizes quoted IPv4 hosts from generated ssh commands', () => {
     const sshArgs = extractSshArgs(
         "timeout 3600 ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o LogLevel=ERROR -o ServerAliveInterval=20 -o ConnectTimeout=10 'root'@'10.0.0.5' 'bash -se' << \\\\$abc\necho hi\nabc"
diff --git a/docker/development/etc/nginx/conf.d/custom.conf b/docker/development/etc/nginx/conf.d/custom.conf
index f26dc30495..4672e3de55 100644
--- a/docker/development/etc/nginx/conf.d/custom.conf
+++ b/docker/development/etc/nginx/conf.d/custom.conf
@@ -2,3 +2,9 @@
 
 # Disable access logs
 access_log off;
+
+# Allow request headers up to 32k (nginx default is 8k). Large JWT cookies can push the
+# Cookie header past 8k, and nginx would then reject the request with a bare 400
+# before it reaches the application.
+client_header_buffer_size 8k;
+large_client_header_buffers 8 32k;
diff --git a/docker/production/etc/nginx/conf.d/custom.conf b/docker/production/etc/nginx/conf.d/custom.conf
index f26dc30495..4672e3de55 100644
--- a/docker/production/etc/nginx/conf.d/custom.conf
+++ b/docker/production/etc/nginx/conf.d/custom.conf
@@ -2,3 +2,9 @@
 
 # Disable access logs
 access_log off;
+
+# Allow request headers up to 32k (nginx default is 8k). Large JWT cookies can push the
+# Cookie header past 8k, and nginx would then reject the request with a bare 400
+# before it reaches the application.
+client_header_buffer_size 8k;
+large_client_header_buffers 8 32k;
diff --git a/other/nightly/versions.json b/other/nightly/versions.json
index 0e83c0cf74..e2d8c18bc8 100644
--- a/other/nightly/versions.json
+++ b/other/nightly/versions.json
@@ -1,7 +1,7 @@
 {
     "coolify": {
         "v4": {
-            "version": "4.3.17"
+            "version": "4.3.19"
         },
         "nightly": {
             "version": "4.4-rc.1"
diff --git a/resources/css/app.css b/resources/css/app.css
index 40af521c69..bf506dbda4 100644
--- a/resources/css/app.css
+++ b/resources/css/app.css
@@ -20,51 +20,152 @@
     --font-geist-sans: 'Geist Sans', Inter, sans-serif;
     --font-logs: 'Geist Mono', 'SFMono-Regular', Consolas, 'Liberation Mono', Menlo, monospace;
 
-    --color-base: #101010;
-    --color-warning: #fcd452;
-    --color-warning-50: #fefce8;
-    --color-warning-100: #fef9c3;
-    --color-warning-200: #fef08a;
-    --color-warning-300: #fde047;
-    --color-warning-400: #fcd452;
-    --color-warning-500: #facc15;
-    --color-warning-600: #ca8a04;
-    --color-warning-700: #a16207;
-    --color-warning-800: #854d0e;
-    --color-warning-900: #713f12;
-    --color-success: #22C55E;
-    --color-error: #dc2626;
-    --color-coollabs-50: #f5f0ff;
-    --color-coollabs: #6b16ed;
-    --color-coollabs-100: #7317ff;
-    --color-coollabs-200: #5a12c7;
-    --color-coollabs-300: #4a0fa3;
-    --color-coolgray-100: #181818;
-    --color-coolgray-200: #202020;
-    --color-coolgray-300: #242424;
-    --color-coolgray-400: #282828;
-    --color-coolgray-500: #323232;
+    --color-base: oklch(17.3% 0 0);
+    --color-warning: oklch(88.13% 0.1507 91.7);
+    --color-warning-50: oklch(98.73% 0.0262 102.21);
+    --color-warning-100: oklch(97.29% 0.0693 103.19);
+    --color-warning-200: oklch(94.51% 0.1243 101.54);
+    --color-warning-300: oklch(90.52% 0.1657 98.11);
+    --color-warning-400: oklch(88.13% 0.1507 91.7);
+    --color-warning-500: oklch(86.06% 0.1731 91.94);
+    --color-warning-600: oklch(68.06% 0.1423 75.83);
+    --color-warning-700: oklch(55.38% 0.1207 66.44);
+    --color-warning-800: oklch(47.62% 0.1034 61.91);
+    --color-warning-900: oklch(42.1% 0.0897 57.71);
+    --color-success: oklch(72.27% 0.192 149.58);
+    --color-error: oklch(57.71% 0.2152 27.33);
+    --color-coollabs-50: oklch(96.33% 0.0206 301.15);
+    --color-coollabs: oklch(49.65% 0.2709 289.33);
+    --color-coollabs-100: oklch(52.34% 0.287 289.16);
+    --color-coollabs-200: oklch(43.76% 0.2369 289.82);
+    --color-coollabs-300: oklch(38.04% 0.2031 290.47);
+    --color-coolgray-100: oklch(20.9% 0 0);
+    --color-coolgray-200: oklch(24.35% 0 0);
+    --color-coolgray-300: oklch(26.03% 0 0);
+    --color-coolgray-400: oklch(27.68% 0 0);
+    --color-coolgray-500: oklch(31.71% 0 0);
 
     /* Graphite design language (ported from ref/frontend). Layered neutral
        surfaces + translucent hairlines. See DESIGN.md. */
-    --color-app: #0c0c0d;
-    /* Canvas: neutral near-black (oklch), not pure black */
-    --color-panel: oklch(10% 0 0);
-    --color-surface: #161618;
-    --color-raised: #1c1c1e;
-    --color-selected: #26262a;
-    --color-fg: #f2f2f2;
-    --color-fg-dim: #b4b4b8;
-    --color-fg-faint: #6e6e74;
-    --color-accent: #6b16ed;
-    --color-accent-foreground: #ffffff;
-    --color-hairline: rgba(255, 255, 255, 0.08);
-    --color-nav-text: #525252;
-    --color-nav-muted: #666666;
-    --color-nav-active: #171717;
-    --color-log: #0d0d0d;
+    /* Content canvas: the darkest shell layer (sRGB ~10). Hex, not oklch:
+       oklch lightness compresses to near-black below ~15%, so oklch(7.5%)
+       renders as sRGB 1 with no visible step. */
+    --color-app: oklch(14.48% 0 0);
+    /* Sidebar + topbar chrome (sRGB ~20): a clear step lighter than the content
+       canvas so the shell chrome separates from the content area. */
+    --color-panel: oklch(19.13% 0 0);
+    /* Pure neutral (r=g=b). Were cool-tinted (#161618/#1c1c1e/#26262a, b>r),
+       which clashed with the neutral panel ladder. */
+    --color-surface: oklch(20.02% 0 0);
+    --color-raised: oklch(22.64% 0 0);
+    --color-selected: oklch(26.86% 0 0);
+    --color-fg: oklch(96.12% 0 0);
+    --color-fg-dim: oklch(76.99% 0 0);
+    /* Tertiary text. Raised from #6e6e74 (3.78:1 on base, failed WCAG AA)
+       to #7e7e84 so 13-14px text clears 4.5:1 on the dark surface ladder. */
+    --color-fg-faint: oklch(59.31% 0 0);
+    --color-accent: oklch(49.65% 0.2709 289.33);
+    --color-accent-foreground: oklch(100.0% 0 0);
+    --color-hairline: oklch(100.0% 0 0 / 0.08);
+    --color-nav-text: oklch(43.86% 0 0);
+    --color-nav-muted: oklch(51.03% 0 0);
+    --color-nav-active: oklch(20.46% 0 0);
+    --color-log: oklch(15.91% 0 0);
 
     --shadow-modal: 0 24px 64px rgba(0, 0, 0, 0.55), 0 4px 16px rgba(0, 0, 0, 0.4);
+    /* One restrained lift shared by every dropdown/menu/listbox panel and the
+       command palette. Lighter and consistent, replacing the old scattered
+       0.45 / 0.35 / shadow-lg / shadow-sm mix. Modals keep --shadow-modal. */
+    --shadow-dropdown: 0 4px 12px rgb(0 0 0 / 0.12), 0 2px 4px rgb(0 0 0 / 0.08);
+
+    /* Shared motion curves (stronger than the built-in CSS easings). Use these
+       for consistency: --ease-out for UI enter/press, --ease-drawer for
+       drawers/sheets, --ease-in-out for on-screen movement. */
+    --ease-out: cubic-bezier(0.23, 1, 0.32, 1);
+    --ease-in-out: cubic-bezier(0.77, 0, 0.175, 1);
+    --ease-drawer: cubic-bezier(0.32, 0.72, 0, 1);
+}
+
+/* Standard buttons have a compact physical edge. Hover lifts the face by 1px;
+   pressing nudges it down while the depth disappears. */
+.button:not(:disabled) {
+    --button-depth-color: rgb(0 0 0 / 0.22);
+    --button-depth: 0 2px 0 var(--button-depth-color);
+    --button-depth-hover: 0 3px 0 var(--button-depth-color);
+
+    box-shadow: var(--button-depth);
+}
+
+.button.button-highlighted:not(:disabled),
+.button[isHighlighted]:not(:disabled) {
+    --button-depth-color: color-mix(in oklab, var(--color-coollabs) 52%, black);
+}
+
+.dark .button:not(.button-highlighted):not(.button-error):not([isHighlighted]):not(:disabled) {
+    --button-depth-color: rgb(255 255 255 / 0.08);
+}
+
+.button.button-error:not(:disabled) {
+    --button-depth-color: var(--color-red-300);
+}
+
+.dark .button.button-error:not(:disabled) {
+    --button-depth-color: var(--color-red-800);
+}
+
+/* Keep the shared focus indicator when the depth shadow owns box-shadow. */
+.button:not(:disabled):focus-visible {
+    box-shadow: var(--button-depth), 0 0 0 1px var(--color-accent);
+}
+
+.button:not(:disabled):hover {
+    transform: translateY(-1px);
+    box-shadow: var(--button-depth-hover);
+}
+
+.button:not(:disabled):hover:focus-visible {
+    box-shadow: var(--button-depth-hover), 0 0 0 1px var(--color-accent);
+}
+
+/* Other button-like controls retain the lighter scale feedback. */
+.button,
+.icon-button,
+.app-tab,
+.split-action-main,
+.split-action-caret {
+    transition-property: color, background-color, border-color, box-shadow, transform;
+    transition-timing-function: var(--ease-out);
+    transition-duration: 120ms;
+}
+
+.button {
+    transition-duration: 120ms, 120ms, 120ms, 80ms, 80ms;
+}
+
+.icon-button:not(:disabled):active,
+.app-tab:active,
+.split-action-main:not(:disabled):active,
+.split-action-caret:not(:disabled):active {
+    transform: scale(0.97);
+}
+
+.button:not(:disabled):active {
+    transform: translateY(2px);
+    box-shadow: none;
+}
+
+/* Focus border/ring on any form control should ease, not snap. The accent
+   focus indicator is a border-color and/or box-shadow (ring) change, which the
+   utilities' `transition-colors` did not fully animate. Target the elements
+   themselves (covers bespoke search fields too) plus the div-based controls. */
+input,
+textarea,
+select,
+.listbox-trigger,
+.chip-input {
+    transition-property: color, background-color, border-color, box-shadow;
+    transition-timing-function: var(--ease-out);
+    transition-duration: 120ms;
 }
 
 /*
@@ -258,7 +359,7 @@
 */
 html,
 body {
-    @apply w-full min-h-full bg-gray-50 dark:bg-app dark:text-fg-dim;
+    @apply w-full min-h-full bg-neutral-50 dark:bg-app dark:text-fg-dim;
 }
 
 body {
@@ -284,8 +385,16 @@ option {
     @apply dark:text-white dark:bg-coolgray-100;
 }
 
-button[isError]:not(:disabled) {
-    @apply text-red-800 dark:text-red-300 bg-red-50 dark:bg-red-900/30 border-red-300 dark:border-red-800 hover:bg-red-300 hover:text-white dark:hover:bg-red-800 dark:hover:text-white;
+.button.button-error {
+    @apply text-red-800 dark:text-red-300 bg-red-50 dark:bg-red-900/30 border-red-300 dark:border-red-800;
+}
+
+.button.button-error:disabled {
+    @apply text-red-800 dark:text-red-300 bg-red-50 dark:bg-red-900/30 border-red-300 dark:border-red-800;
+}
+
+.button-error:not(:disabled) {
+    @apply hover:bg-red-100 hover:text-red-900 dark:hover:bg-red-700 dark:hover:text-white;
 }
 
 button[isHighlighted]:not(:disabled) {
@@ -505,25 +614,24 @@ html[data-theme="custom"] #nprogress .spinner-icon {
 
 .application-console-shell[data-console-theme="system"],
 .terminal-fullscreen-shell[data-console-theme="system"] {
-    --console-theme-background: #fff;
-    --console-theme-border: #d4d4d8;
+    --console-theme-background: oklch(100.0% 0 0);
+    --console-theme-border: oklch(87.11% 0.0055 286.29);
     --console-theme-opacity: 1;
 }
 
-html:not(.dark) .application-console-shell[data-console-theme="system"] .application-console-header {
-    background: transparent;
-    color: #52525b;
-    border-color: rgb(0 0 0 / 0.1);
-    backdrop-filter: none;
-}
-
-html:not(.dark) .application-console-shell[data-console-theme="system"] .application-console-header [class*="text-white"] {
+/* Session toolbar (selected-target trigger + label) sits over the white
+   system console in light mode. Without this its text-white/* stayed white on
+   white and the selected server was invisible (issue #11532). */
+html:not(.dark) .application-console-shell[data-console-theme="system"] .terminal-session-toolbar[class*="text-white"],
+html:not(.dark) .application-console-shell[data-console-theme="system"] .terminal-session-toolbar [class*="text-white"],
+html:not(.dark) .terminal-fullscreen-shell[data-console-theme="system"] .terminal-session-toolbar[class*="text-white"],
+html:not(.dark) .terminal-fullscreen-shell[data-console-theme="system"] .terminal-session-toolbar [class*="text-white"] {
     color: #52525b !important;
 }
 
 html.dark .application-console-shell[data-console-theme="system"],
 html.dark .terminal-fullscreen-shell[data-console-theme="system"] {
-    --console-theme-background: #121214;
+    --console-theme-background: oklch(18.31% 0.004 285.99);
     --console-theme-border: rgb(255 255 255 / 0.08);
 }
 
@@ -533,6 +641,19 @@ html[data-theme="custom"] .terminal-fullscreen-shell[data-console-theme="system"
     --console-theme-border: var(--coollabs-line);
 }
 
+/* Docked System console only: the fill behind the terminal panel is the
+   elevated (header) surface, so the panel's rounded-corner notch reads as the
+   header colour — the card's figure/ground. The panel paints its own base
+   surface over this fill, so only the notch shows it. The fullscreen shell has
+   no panel, so it is intentionally excluded and keeps its plain terminal fill. */
+.application-console-shell[data-console-theme="system"] {
+    --console-theme-background: var(--coollabs-elevated);
+}
+
+html.dark .application-console-shell[data-console-theme="system"] {
+    --console-theme-background: var(--coollabs-elevated);
+}
+
 .console-theme-selector {
     scrollbar-color: rgb(161 161 170) transparent;
     scrollbar-width: thin;
@@ -656,6 +777,10 @@ html.dark .console-theme-selector::-webkit-scrollbar-thumb {
     flex: 1 1 0%;
     flex-direction: column;
     overflow: hidden;
+    /* Breathing room so the console's box-shadow ring + lift are not clipped by
+       this overflow-hidden, viewport-height container (the card gets this from
+       the scrollable page around it). */
+    padding: 6px;
 }
 
 .terminal-page-console > .application-console-shell {
@@ -712,11 +837,71 @@ body.terminal-is-fullscreen .terminal-fullscreen-shell [data-terminal-mobile-too
     touch-action: manipulation;
 }
 
-.application-console-header {
+/* Session header band: an attached card-style header on top of the console,
+   mirroring the page card header (elevated surface + hairline divider). The
+   System theme uses the neutral card surface in both modes; colorful themes
+   fall back to a translucent dark band so the white controls stay legible. */
+.terminal-session-toolbar {
     position: relative;
     z-index: 2;
-    background: rgb(0 0 0 / 0.24);
-    backdrop-filter: blur(20px);
+    flex-shrink: 0;
+    min-height: 3rem;
+    padding: 0.5rem 0.75rem 0.5rem 1rem;
+    /* No border-radius: the shell is overflow-hidden + rounded and clips the
+       header's top corners, so rounding here only risks a sub-pixel seam. */
+    border-bottom: 1px solid var(--terminal-header-border, rgb(255 255 255 / 0.1));
+    background: var(--terminal-header-bg, rgb(0 0 0 / 0.28));
+    -webkit-backdrop-filter: blur(12px);
+    backdrop-filter: blur(12px);
+}
+
+/* System header has no bottom border: the body panel's ring is the divider, and
+   its rounded top corners tuck under the header — the same merge the
+   target-picker card uses (elevated header meeting a base body panel). */
+.application-console-shell[data-console-theme="system"] .terminal-session-toolbar {
+    --terminal-header-bg: var(--coollabs-elevated);
+    --terminal-header-border: transparent;
+    /* Shell no longer clips (overflow: visible), so the header rounds its own
+       top corners — matching the card header. */
+    border-radius: 8px 8px 0 0;
+    /* Drop the z-index:2 stacking context: it painted the header OVER the body
+       panel, hiding the panel's ring (the divider). The header only had z-2 to
+       beat ::before, but its dropdowns sit in their own .relative wrappers, so
+       z:auto is safe and lets the body panel's ring paint over the header —
+       exactly how the card body overlaps the card header. */
+    z-index: auto;
+    -webkit-backdrop-filter: none;
+    backdrop-filter: none;
+}
+
+/* System console body: the terminal panel, a full rounded box-shadow ring like
+   the card body. Its base surface is the terminal fill; the elevated surface
+   behind it (::before) shows only through the rounded-corner notch, reading as
+   the header colour — the card's figure/ground. */
+.application-console-shell[data-console-theme="system"] .terminal-session-panel {
+    background: var(--coollabs-base);
+    /* The body panel is a full rounded ring (like the card body). position:
+       relative puts it (and its ring) above ::before AND, because it comes
+       after the now-z:auto header in the DOM, above the header — so the ring's
+       top edge is the divider and its rounded top corners connect down into the
+       side ring, which coincides with the shell's ring (one hairline, no
+       doubling). A box-shadow ring rounds and connects cleanly; a border-top
+       cannot (square corners, or a disconnected transparent edge). */
+    position: relative;
+    border-radius: 8px;
+    box-shadow: 0 0 0 1px var(--coollabs-hairline);
+}
+
+/* Connected System console frame = the target-picker card recipe: a hairline
+   box-shadow ring + a restrained lift. overflow stays visible so the ring is
+   not clipped (the .terminal-page-console padding gives it room inside the
+   viewport-locked, overflow-hidden page). Colorful themes keep the themed,
+   overflow-hidden shell. */
+.application-console-shell[data-console-theme="system"] {
+    overflow: visible;
+    box-shadow:
+        0 0 0 1px var(--coollabs-hairline),
+        0 1px 2px 0 rgb(0 0 0 / 0.05);
 }
 
 .terminal-loading-label {
@@ -824,7 +1009,7 @@ html:not(.dark) .application-console-shell[data-console-theme="system"] .termina
 }
 
 html:not(.dark) .application-console-shell[data-console-theme="system"] .terminal-session-panel {
-    background: transparent;
+    background: var(--coollabs-base);
 }
 
 .terminal-target-list {
@@ -851,7 +1036,7 @@ html:not(.dark) .application-console-shell[data-console-theme="system"] .termina
     color: #52525b;
     background: #fff;
     border-color: #d4d4d8;
-    box-shadow: 0 18px 50px rgb(0 0 0 / 0.18);
+    box-shadow: var(--shadow-dropdown);
 }
 
 html:not(.dark) .application-console-shell[data-console-theme="system"] .terminal-target-picker [class*="text-white"] {
@@ -924,75 +1109,166 @@ html:not(.dark) .application-console-shell[data-console-theme="system"] .termina
 * utility classes placed in the card markup.
 */
 :root {
-    --coollabs-canvas: oklch(98.75% 0 0);
+    /* Page canvas is a faint off-white so white/elevated cards lift off it
+       (shadcn pattern), instead of card and page reading as one flat color. */
+    --coollabs-canvas: oklch(97% 0 0);
     --coollabs-elevated: oklch(98% 0 0);
     --coollabs-recessed: oklch(96% 0 0);
-    --coollabs-base: #ffffff;
+    --coollabs-base: oklch(100.0% 0 0);
     --coollabs-fill: oklch(92.2% 0 0);
     --coollabs-line: oklch(14.5% 0 0 / 0.1);
-    --coollabs-hairline: oklch(93.5% 0 0);
-    --coollabs-subtle: oklch(55.6% 0 0);
+    /* Card/table edge ring. Crisped from 93.5% (1.17:1 on canvas, invisible)
+       to 85.5% (1.51:1) so surfaces read as bordered cards, not flat fills. */
+    --coollabs-hairline: oklch(85.5% 0 0);
+    /* Muted labels/titles. Darkened from 55.6% (failed WCAG AA on elevated
+       4.46, recessed 4.24, fill 3.76) to 50% so muted text clears 4.5:1 on
+       every light surface above white. Dark stays 70.8% (already passes). */
+    --coollabs-subtle: oklch(50% 0 0);
 }
 
 .dark {
-    --color-accent: #fcd452;
-    --coollabs-canvas: oklch(10% 0 0);
-    /* elevated (card shells/headers) and recessed (input fills) sit a touch
-       above the canvas so they read lighter than near-black */
-    --coollabs-elevated: oklch(15% 0 0);
-    --coollabs-recessed: oklch(20% 0 0);
-    --coollabs-base: oklch(17% 0 0);
-    --coollabs-fill: oklch(26.9% 0 0);
+    --color-accent: oklch(88.13% 0.1507 91.7);
+    /* Dark surface ladder in hex (sRGB), not oklch: oklch lightness compresses
+       to near-black below ~15%, so oklch(15%) rendered as sRGB 11 and cards
+       could not lift off the content canvas (sRGB 10). These give clear,
+       visible steps: content 10 -> elevated 22 -> base 28 -> recessed 34.
+       Pure neutral (r=g=b), matching the neutral borders/text and the light
+       ladder, so every panel shares one temperature (no blue cast). */
+    --coollabs-canvas: oklch(14.48% 0 0);
+    --coollabs-elevated: oklch(20.02% 0 0);
+    --coollabs-recessed: oklch(25.2% 0 0);
+    --coollabs-base: oklch(22.64% 0 0);
+    --coollabs-fill: oklch(29.31% 0 0);
     --coollabs-line: oklch(32% 0 0);
-    --coollabs-hairline: oklch(26.9% 0 0);
+    /* Crisped from 26.9% (1.36:1 on canvas) to 32% (1.63:1) so dark cards
+       and tables show a visible edge instead of blending into the canvas. */
+    --coollabs-hairline: oklch(32% 0 0);
     --coollabs-subtle: oklch(70.8% 0 0);
-    --color-nav-text: #a8a8b0;
-    --color-nav-muted: #7a7a84;
-    --color-nav-active: #f2f2f2;
+    /* Neutral (was #a8a8b0 / #7a7a84, both cool-tinted). Sidebar text now shares
+       the same neutral temperature as the content text, so the sidebar no longer
+       reads cooler than the panels/cards. */
+    --color-nav-text: oklch(73.8% 0 0);
+    /* Raised from 58.97% (4.47:1 on panel, just under AA) to 61% (4.86:1) so the
+       11px sidebar section labels clear 4.5:1. */
+    --color-nav-muted: oklch(61% 0 0);
+    --color-nav-active: oklch(96.12% 0 0);
+    /* Tertiary text. Base token (59.31%) only clears 4.5:1 on app/panel; it
+       failed on surface/raised/selected (4.46/4.20/3.73). Raised to 64% so the
+       313 dark:text-fg-faint usages clear AA across the whole surface ladder,
+       while staying clearly dimmer than fg-dim (76.99%). */
+    --color-fg-faint: oklch(65% 0 0);
+    /* Error text. The base error red (57.71%) failed on every dark surface
+       (4.10/3.75/3.53). Brightened for dark mode so text-error clears AA on the
+       card ladder while staying unmistakably red. */
+    --color-error: oklch(66% 0.2 27.33);
+}
+
+/* Light-mode semantic text.
+   warning / success / error double as the bright brand accent and as solid
+   fills, which only appear under `dark:` — so in light mode these tokens are
+   used almost entirely as text, translucent tints (bg-warning/10) and borders.
+   The bright values (yellow 88%, green 72%) and the base red (57.71%) fail AA
+   as text on white and the light surface ladder (warning 1.43, success 2.28,
+   error 4.43 on canvas). Scoped to `:not(.dark)` so dark keeps the brand
+   colors and the custom theme keeps its own overrides. Every value clears
+   4.5:1 on white, canvas, elevated, recessed and fill, and is in sRGB gamut. */
+html:not(.dark) {
+    --color-warning: oklch(50% 0.105 80);
+    --color-success: oklch(48% 0.135 149.58);
+    --color-error: oklch(52% 0.2 27.33);
 }
 
 /* Theme surfaces are derived from one brand color. Changing
    --theme-base-color is enough to generate a complete dark surface ladder. */
 html[data-theme="custom"] {
-    --theme-base-color: #6b16ed;
-    --theme-bright-color: color-mix(in srgb, var(--theme-base-color) 85%, white);
+    --theme-base-color: oklch(49.65% 0.2709 289.33);
+    --theme-bright-color: color-mix(in srgb, var(--theme-base-color) 85%, oklch(100% 0 0));
     --theme-scrollbar-thumb: color-mix(in srgb, var(--theme-bright-color) 70%, var(--theme-accent-foreground));
-    --theme-border-color: color-mix(in oklab, var(--theme-base-color) 42%, #52525b);
-    --theme-placeholder-color: color-mix(in srgb, white 20%, var(--theme-base-color));
+    --theme-border-color: color-mix(in oklab, var(--theme-base-color) 42%, oklch(44.19% 0.0146 285.79));
+    /* Accent text/icons sit directly on dark surfaces. Force the lightness into a
+       readable band (and tame chroma) so any picked hue keeps enough contrast. */
+    --theme-fg-on-surface: oklch(from var(--theme-base-color) clamp(0.72, l, 0.86) min(c, 0.13) h);
+    /* Placeholders read as a light, near-neutral hint of the hue - never the raw
+       (possibly dark) base color, which is invisible on the dark input. */
+    --theme-placeholder-color: oklch(from var(--theme-base-color) 0.62 min(c, 0.03) h);
     --color-accent: var(--theme-bright-color);
     --color-coollabs: var(--theme-bright-color);
-    --color-coollabs-100: color-mix(in oklab, var(--theme-bright-color) 88%, white);
-    --color-coollabs-200: color-mix(in oklab, var(--theme-bright-color) 88%, black);
-    --color-coollabs-300: color-mix(in oklab, var(--theme-bright-color) 72%, black);
+    --color-coollabs-100: color-mix(in oklab, var(--theme-bright-color) 88%, oklch(100% 0 0));
+    --color-coollabs-200: color-mix(in oklab, var(--theme-bright-color) 88%, oklch(0% 0 0));
+    --color-coollabs-300: color-mix(in oklab, var(--theme-bright-color) 72%, oklch(0% 0 0));
     /* Legacy dark-theme accent utilities use warning as the brand color. */
     --color-warning: var(--theme-bright-color);
     --color-accent-foreground: var(--theme-accent-foreground);
-    --color-app: color-mix(in oklab, var(--theme-base-color) 12%, #09090a);
-    --color-panel: color-mix(in oklab, var(--theme-base-color) 14%, #0c0c0d);
-    --color-surface: color-mix(in oklab, var(--theme-base-color) 18%, #101011);
-    --color-raised: color-mix(in oklab, var(--theme-base-color) 24%, #141416);
-    --color-selected: color-mix(in oklab, var(--theme-base-color) 32%, #18181a);
+    --color-app: color-mix(in oklab, var(--theme-base-color) 12%, oklch(14.03% 0.0022 286.11));
+    --color-panel: color-mix(in oklab, var(--theme-base-color) 14%, oklch(15.48% 0.0021 286.15));
+    --color-surface: color-mix(in oklab, var(--theme-base-color) 18%, oklch(17.35% 0.0020 286.18));
+    --color-raised: color-mix(in oklab, var(--theme-base-color) 24%, oklch(19.21% 0.0040 286.02));
+    --color-selected: color-mix(in oklab, var(--theme-base-color) 32%, oklch(20.99% 0.0039 286.06));
     --color-coolgray-100: var(--color-surface);
     --color-coolgray-200: var(--color-raised);
     --color-coolgray-300: var(--color-selected);
-    --color-coolgray-400: color-mix(in oklab, var(--theme-base-color) 28%, #1b1b1e);
-    --color-coolgray-500: color-mix(in oklab, var(--theme-base-color) 32%, #202024);
+    --color-coolgray-400: color-mix(in oklab, var(--theme-base-color) 28%, oklch(22.34% 0.0058 285.92));
+    --color-coolgray-500: color-mix(in oklab, var(--theme-base-color) 32%, oklch(24.52% 0.0075 285.83));
     --coollabs-canvas: var(--color-app);
     --coollabs-elevated: var(--color-surface);
     --coollabs-recessed: var(--color-raised);
-    --coollabs-base: color-mix(in oklab, var(--theme-base-color) 22%, #111112);
+    --coollabs-base: color-mix(in oklab, var(--theme-base-color) 22%, oklch(17.81% 0.0020 286.19));
     --color-content-surface: var(--coollabs-base);
-    --coollabs-fill: color-mix(in oklab, var(--theme-base-color) 32%, #18181a);
+    --coollabs-fill: color-mix(in oklab, var(--theme-base-color) 32%, oklch(20.99% 0.0039 286.06));
     --coollabs-line: var(--theme-border-color);
     --coollabs-hairline: color-mix(in srgb, var(--theme-border-color) 55%, var(--color-panel));
-    --color-nav-text: #e4dfea;
-    --color-nav-muted: #d8d2df;
-    --color-nav-active: #ffffff;
-    --color-log: color-mix(in oklab, var(--theme-base-color) 20%, #080809);
-    --color-log-toolbar: color-mix(in oklab, var(--theme-base-color) 26%, #101011);
-    --color-fg-dim: #e4dfea;
-    --color-fg-faint: #d8d2df;
-    --coollabs-subtle: #d8d2df;
+    --color-nav-text: oklch(91.08% 0.0157 306.4);
+    --color-nav-muted: oklch(87.24% 0.0188 306.63);
+    --color-nav-active: oklch(100.0% 0 0);
+    --color-log: color-mix(in oklab, var(--theme-base-color) 20%, oklch(13.49% 0.0024 286.07));
+    --color-log-toolbar: color-mix(in oklab, var(--theme-base-color) 26%, oklch(17.35% 0.0020 286.18));
+    --color-fg-dim: oklch(91.08% 0.0157 306.4);
+    --color-fg-faint: oklch(87.24% 0.0188 306.63);
+    --coollabs-subtle: oklch(87.24% 0.0188 306.63);
+}
+
+/* Light custom theme: the same single brand color, but surfaces tint toward
+   white and every foreground token flips to a dark, readable band. This selector
+   outranks the plain html:not(.dark) light palette, so it wins where they meet.
+   Accent fills (--theme-bright-color, --color-warning/coollabs) are inherited from
+   the block above so the JS-computed --theme-accent-foreground stays consistent. */
+html[data-theme="custom"]:not(.dark) {
+    --theme-scrollbar-thumb: color-mix(in srgb, var(--theme-base-color) 45%, oklch(60% 0 0));
+    /* Accent text/icons on light surfaces: force lightness into a dark band. */
+    --theme-fg-on-surface: oklch(from var(--theme-base-color) clamp(0.30, l, 0.48) min(c, 0.16) h);
+    /* Placeholder: medium-dark, near-neutral hint of the hue. */
+    --theme-placeholder-color: oklch(from var(--theme-base-color) 0.50 min(c, 0.03) h);
+    /* Surfaces hold a fixed high lightness (stays light, keeps dark text readable)
+       while injecting the base hue's chroma, so the tint is actually visible.
+       color-mix into white coupled lightness to the base and washed the tint out
+       (a 4% mix of any color into near-white is imperceptible). */
+    --color-app: oklch(from var(--theme-base-color) 96.5% min(c, 0.035) h);
+    --color-panel: oklch(from var(--theme-base-color) 98.5% min(c, 0.025) h);
+    --color-surface: oklch(from var(--theme-base-color) 98% min(c, 0.03) h);
+    --color-raised: oklch(from var(--theme-base-color) 95.5% min(c, 0.04) h);
+    --color-selected: oklch(from var(--theme-base-color) 92% min(c, 0.05) h);
+    --color-coolgray-100: var(--color-surface);
+    --color-coolgray-200: var(--color-raised);
+    --color-coolgray-300: var(--color-selected);
+    --color-coolgray-400: oklch(from var(--theme-base-color) 90% min(c, 0.05) h);
+    --color-coolgray-500: oklch(from var(--theme-base-color) 87% min(c, 0.055) h);
+    --coollabs-canvas: var(--color-app);
+    --coollabs-elevated: oklch(from var(--theme-base-color) 98.5% min(c, 0.025) h);
+    --coollabs-recessed: var(--color-raised);
+    --coollabs-base: oklch(from var(--theme-base-color) 99.3% min(c, 0.018) h);
+    --color-content-surface: var(--coollabs-base);
+    --coollabs-fill: oklch(from var(--theme-base-color) 91% min(c, 0.05) h);
+    --coollabs-line: oklch(from var(--theme-base-color) 82% min(c, 0.055) h);
+    --coollabs-hairline: oklch(from var(--theme-base-color) 88% min(c, 0.04) h);
+    --color-nav-text: oklch(from var(--theme-base-color) 0.40 min(c, 0.04) h);
+    --color-nav-muted: oklch(from var(--theme-base-color) 0.50 min(c, 0.03) h);
+    --color-nav-active: oklch(from var(--theme-base-color) 0.22 min(c, 0.05) h);
+    --color-log: oklch(from var(--theme-base-color) 96.5% min(c, 0.035) h);
+    --color-log-toolbar: oklch(from var(--theme-base-color) 93% min(c, 0.045) h);
+    --color-fg: oklch(from var(--theme-base-color) 0.22 min(c, 0.04) h);
+    --color-fg-dim: oklch(from var(--theme-base-color) 0.40 min(c, 0.04) h);
+    --color-fg-faint: oklch(from var(--theme-base-color) 0.50 min(c, 0.03) h);
+    --coollabs-subtle: oklch(from var(--theme-base-color) 0.50 min(c, 0.03) h);
 }
 
 html[data-theme="custom"] .control-selected,
@@ -1051,7 +1327,55 @@ html[data-theme="custom"] [class~="dark:bg-white/[0.025]"] {
 html[data-theme="custom"] input::placeholder,
 html[data-theme="custom"] textarea::placeholder {
     color: var(--theme-placeholder-color) !important;
-    opacity: 0.7;
+    /* The token is already a readable light tone; no extra opacity dampening,
+       which would drop it back below the contrast floor. */
+    opacity: 1;
+}
+
+/* Accent text/icons (links, badges, "update available" pill, check marks) use the
+   brand color as foreground on dark surfaces. Route them to the clamped, always
+   readable token; fills (bg-*) keep the brighter accent + its computed foreground. */
+html[data-theme="custom"] :is(
+    [class~="text-coollabs"],
+    [class~="text-warning"],
+    [class~="text-accent"],
+    [class~="dark:text-coollabs"],
+    [class~="dark:text-warning"]
+) {
+    color: var(--theme-fg-on-surface) !important;
+}
+
+html[data-theme="custom"] [class~="hover:text-coollabs"]:hover,
+html[data-theme="custom"] [class~="hover:text-warning"]:hover,
+html[data-theme="custom"] [class~="dark:hover:text-warning"]:hover,
+html[data-theme="custom"] [class~="dark:hover:text-coollabs"]:hover {
+    color: var(--theme-fg-on-surface) !important;
+}
+
+/* Light custom theme reaches raw neutral utilities too. Dark mode tints
+   everything through the pervasive dark:bg-*/dark:border-* utilities (which
+   resolve to --color-* vars the block overrides); light mode has no equivalent,
+   so components fall back to hardcoded neutrals. Remap the dominant light
+   surface/border utilities to the tinted custom vars so the color reaches the
+   whole UI, not just design-system classes. */
+html[data-theme="custom"]:not(.dark) :is([class~="bg-white"], [class~="bg-white/95"], [class~="bg-white/80"]) {
+    background-color: var(--coollabs-elevated) !important;
+}
+
+html[data-theme="custom"]:not(.dark) [class~="bg-neutral-50"] {
+    background-color: var(--coollabs-canvas) !important;
+}
+
+html[data-theme="custom"]:not(.dark) :is([class~="bg-neutral-100"], [class~="bg-neutral-200"]) {
+    background-color: var(--coollabs-fill) !important;
+}
+
+html[data-theme="custom"]:not(.dark) [class~="border-neutral-200"] {
+    border-color: var(--coollabs-hairline) !important;
+}
+
+html[data-theme="custom"]:not(.dark) :is([class~="border-neutral-300"], [class~="border-neutral-100"]) {
+    border-color: var(--coollabs-line) !important;
 }
 
 html[data-theme="custom"] input:read-only,
@@ -1318,27 +1642,6 @@ html[data-theme="custom"] textarea:disabled {
     margin-top: 1.75rem;
 }
 
-.error-contact-link {
-    display: inline-flex;
-    align-items: center;
-    gap: 0.25rem;
-    margin-left: 0.25rem;
-    font-size: 0.8125rem;
-    font-weight: 500;
-    color: #525252;
-    text-underline-offset: 3px;
-    transition: color 0.15s ease;
-}
-
-.dark .error-contact-link {
-    color: var(--color-fg-dim);
-}
-
-.error-contact-link:hover {
-    color: var(--color-accent);
-    text-decoration: underline;
-}
-
 /* Layer card root: elevated shell with a hairline ring. overflow stays
    visible so floating panels (listbox, tooltips) can escape the card. */
 .application-settings-section {
@@ -1349,7 +1652,9 @@ html[data-theme="custom"] textarea:disabled {
     border-radius: 8px;
     border: none;
     background: var(--coollabs-elevated);
-    box-shadow: 0 0 0 1px var(--coollabs-hairline);
+    /* crisp ring + a restrained lift so the card separates from the canvas
+       (shadcn-style), not a heavy floating shadow */
+    box-shadow: 0 0 0 1px var(--coollabs-hairline), 0 1px 2px 0 rgb(0 0 0 / 0.05);
     /* keep anchored scrolls (scrollIntoView) clear of the fixed topbar + layer-2 nav */
     scroll-margin-top: 7rem;
 }
@@ -1415,7 +1720,14 @@ html[data-theme="custom"] textarea:disabled {
     font-weight: 500;
     line-height: 1.25rem;
     letter-spacing: 0;
-    color: inherit;
+    /* Card title is a heading, so give it a readable strength instead of the
+       muted --coollabs-subtle (5.66:1 light / 6.98:1 dark). ~8.7:1 in both
+       modes (comfortable AAA) while descriptions/labels stay muted. */
+    color: oklch(40% 0 0);
+}
+
+.dark .application-settings-section > :is(header, .application-settings-section-header) :is(h2, h3) {
+    color: var(--color-fg-dim);
 }
 
 .application-settings-section > .application-settings-section-header p {
@@ -1425,12 +1737,16 @@ html[data-theme="custom"] textarea:disabled {
     color: var(--coollabs-subtle);
 }
 
-/* Layer card body: nested rounded panel with base bg + fill ring */
+/* Layer card body: nested rounded panel with base bg. Ring uses the same
+   --coollabs-hairline as the card shell (line ~1456) so the body edge and the
+   header edge read as one continuous border instead of two different grays
+   (fill was lighter than hairline, so the header sides and body sides did not
+   match). */
 .application-settings-section-body {
     position: relative;
     border-radius: 8px;
     background: var(--coollabs-base);
-    box-shadow: 0 0 0 1px var(--coollabs-fill);
+    box-shadow: 0 0 0 1px var(--coollabs-hairline);
     padding: 1rem;
 }
 
@@ -1469,28 +1785,71 @@ html[data-theme="custom"] textarea:disabled {
 }
 
 @media (min-width: 1280px) {
+    /* Fixed like the main sidebar (3rem → bottom); left tracks its width (--sidebar-w).
+       Fixed leaves the grid, so the content sibling is pinned to column 2 below. */
     .application-settings-navigation {
-        position: sticky;
-        top: calc(3rem + 1.75rem);
-        align-self: start;
-        max-height: calc(100dvh - 5.5rem);
-        padding-right: 0.375rem;
+        position: fixed;
+        top: 3rem;
+        left: var(--sidebar-w, 14rem);
+        width: calc(210px + 2.5rem);
+        height: calc(100dvh - 3rem);
         overflow-x: hidden;
         overflow-y: auto;
         overscroll-behavior: contain;
         scrollbar-width: thin;
+        scrollbar-color: var(--coollabs-fill) transparent;
+        scrollbar-gutter: stable;
+        --rail-fill: var(--coollabs-elevated);
+        padding: 0.5rem;
+        background: var(--rail-fill);
+        border-right: 1px solid var(--coollabs-hairline);
+        transition: left 200ms ease;
     }
 
-    /* Resource pages have a second fixed header row below the main header. */
-    .application-settings-workspace > .application-settings-navigation {
-        top: 4rem;
-        max-height: calc(100dvh - 5rem);
+    .application-settings-navigation ~ * {
+        grid-column: 2;
     }
 
+    html:not(.dark) .application-settings-navigation {
+        --rail-fill: var(--coollabs-base);
+    }
+
+    .application-settings-navigation::-webkit-scrollbar {
+        width: 6px;
+    }
+
+    .application-settings-navigation::-webkit-scrollbar-track {
+        background: transparent;
+    }
+
+    .application-settings-navigation::-webkit-scrollbar-thumb {
+        border-radius: 9999px;
+        background: var(--coollabs-fill);
+    }
+
+    .application-settings-navigation::-webkit-scrollbar-thumb:hover {
+        background: var(--coollabs-line);
+    }
+
+    /* Embeds: keep the surface, drop the fixed positioning. */
     .application-settings-navigation.is-flush {
         position: static;
-        max-height: none;
+        inset: auto;
+        width: auto;
+        height: auto;
         overflow: visible;
+        transition: none;
+    }
+}
+
+/* Honor reduced-motion for the settings nav disclosure/accordion and the mobile
+   sidebar sheet: keep open/close functional but drop the height/slide/fade. */
+@media (prefers-reduced-motion: reduce) {
+    .application-settings-navigation,
+    .application-settings-navigation *,
+    .mobile-sidebar-sheet * {
+        transition-duration: 0.01ms !important;
+        animation-duration: 0.01ms !important;
     }
 }
 
@@ -1560,7 +1919,7 @@ html[data-theme="custom"] textarea:disabled {
 .application-settings-form .input:focus-visible,
 .application-settings-form .select:focus-visible {
     border-color: var(--color-accent);
-    box-shadow: 0 0 0 1px var(--color-accent) !important;
+    box-shadow: none !important;
 }
 
 .application-settings-workspace textarea.input,
@@ -1603,7 +1962,7 @@ html[data-theme="custom"] textarea:disabled {
  * Circular chevrons sit over gradient fades when more tabs are off-screen.
  */
 .resource-heading-tabs-scroller {
-    --resource-heading-tabs-fade: #f5f5f5; /* neutral-100, matches pill track */
+    --resource-heading-tabs-fade: oklch(97.02% 0 0); /* neutral-100, matches pill track */
 }
 
 .dark .resource-heading-tabs-scroller {
@@ -1662,7 +2021,7 @@ html[data-theme="custom"] textarea:disabled {
     margin-inline: 0.25rem;
     border-radius: 9999px;
     color: #737373;
-    background: #ffffff;
+    background: var(--coollabs-base);
     box-shadow:
         0 1px 2px rgba(0, 0, 0, 0.06),
         0 0 0 1px rgba(0, 0, 0, 0.08);
@@ -1736,20 +2095,6 @@ html[data-theme="custom"] textarea:disabled {
     box-shadow: none !important;
 }
 
-.resource-heading-overflow-separator {
-    width: 1px;
-    align-self: stretch;
-    margin: 0.25rem 0.25rem;
-    background: color-mix(in srgb, var(--coollabs-line) 80%, transparent);
-}
-
-.resource-heading-overflow.is-collapsed .resource-heading-overflow-separator {
-    width: auto;
-    height: 1px;
-    align-self: auto;
-    margin: 0.25rem 0.375rem;
-}
-
 .resource-heading-overflow.is-collapsed .resource-heading-overflow-items > .button,
 .resource-heading-overflow.is-collapsed .resource-heading-overflow-items > a.button {
     width: 100%;
@@ -1870,6 +2215,61 @@ html[data-theme="custom"] textarea:disabled {
     flex-shrink: 0;
 }
 
+.split-action {
+    display: inline-flex;
+}
+
+.split-action-main,
+.split-action-caret {
+    @apply button-highlighted;
+    display: inline-flex;
+    align-items: center;
+    justify-content: center;
+    gap: 0.375rem;
+    height: 2rem;
+    font-size: 13px;
+    font-weight: 500;
+    white-space: nowrap;
+    cursor: pointer;
+}
+
+.split-action-main {
+    flex: 1 1 auto;
+    min-width: 0;
+    padding: 0 0.625rem;
+    border-radius: 6px 0 0 6px;
+}
+
+.split-action-caret {
+    flex-shrink: 0;
+    width: 1.75rem;
+    border-left: 1px solid rgba(255, 255, 255, 0.25);
+    border-radius: 0 6px 6px 0;
+}
+
+.split-action > .split-action-main:only-of-type {
+    border-radius: 6px;
+}
+
+.split-action-main:disabled,
+.split-action-caret:disabled {
+    cursor: not-allowed;
+    opacity: 0.45;
+}
+
+.split-action-main:focus-visible,
+.split-action-caret:focus-visible {
+    outline: none;
+    position: relative;
+    z-index: 1;
+    box-shadow: 0 0 0 3px color-mix(in oklab, var(--color-accent) 40%, transparent);
+}
+
+.application-heading-actions .split-action-main,
+.application-heading-actions .split-action-caret {
+    height: 1.75rem;
+}
+
 /* Custom listbox (replaces native <select>) */
 .listbox-trigger {
     display: flex;
@@ -1919,7 +2319,7 @@ html[data-theme="custom"] textarea:disabled {
 .listbox-trigger:focus-visible {
     outline: none;
     border-color: var(--color-accent);
-    box-shadow: 0 0 0 1px var(--color-accent);
+    box-shadow: none;
 }
 
 .listbox-panel {
@@ -1944,7 +2344,7 @@ html[data-theme="custom"] textarea:disabled {
     border-radius: 10px;
     border: 1px solid var(--coollabs-line);
     background: var(--coollabs-recessed);
-    box-shadow: 0 12px 32px rgba(0, 0, 0, 0.45);
+    box-shadow: var(--shadow-dropdown);
 }
 
 @media (max-width: 767px) {
@@ -2040,7 +2440,7 @@ html[data-theme="custom"] textarea:disabled {
 .searchable-listbox-search-input:focus {
     outline: none;
     border-color: var(--color-accent);
-    box-shadow: 0 0 0 1px var(--color-accent);
+    box-shadow: none;
 }
 
 /* Hide native WebKit search clear so custom clear buttons are not doubled */
@@ -2521,7 +2921,7 @@ input[type="search"]::-webkit-search-results-decoration {
 }
 
 .service-backup-table-grid {
-    grid-template-columns: minmax(10rem, 1.7fr) 6rem minmax(7rem, 0.8fr) 7.5rem 6.5rem minmax(8rem, 1fr) 7.5rem;
+    grid-template-columns: minmax(10rem, 1.7fr) 6rem minmax(7rem, 0.8fr) 7.5rem 6.5rem minmax(8rem, 1fr) 12.5rem;
     width: 100%;
 }
 
@@ -2673,7 +3073,10 @@ input[type="search"]::-webkit-search-results-decoration {
     }
 
     .volumes-col-backup {
-        align-items: flex-start;
+        flex-direction: row;
+        align-items: center;
+        justify-content: flex-start;
+        gap: 0.5rem;
     }
 
     .volumes-cell-actions {
@@ -3006,7 +3409,7 @@ input[type="search"]::-webkit-search-results-decoration {
 /* Shared logs viewer (deployment + runtime) — mobile-first toolbar
    Mobile stacks: search → meta → full-width actions (no side-by-side overlap). */
 .logs-viewer {
-    background: #fff;
+    background: var(--coollabs-base);
     color: #262626;
 }
 
@@ -3507,7 +3910,7 @@ html[data-theme="custom"] .logs-viewer-timestamp {
 .runtime-log-viewport {
     min-height: 12rem;
     border-radius: 0 0 8px 8px;
-    background: #fafafa;
+    background: var(--coollabs-elevated);
     color: #262626;
 }
 
@@ -3522,10 +3925,6 @@ html[data-theme="custom"] .logs-viewer-timestamp {
     color: var(--color-fg-dim);
 }
 
-.env-table-detail {
-    padding: 0.25rem 1rem 1.25rem;
-}
-
 /* Small pill badges for table cells */
 .table-badge {
     display: inline-flex;
@@ -3603,7 +4002,7 @@ html[data-theme="custom"] .logs-viewer-timestamp {
 
 .chip-input:focus-within {
     border-color: var(--color-accent);
-    box-shadow: 0 0 0 1px var(--color-accent);
+    box-shadow: none;
 }
 
 .chip-input input {
@@ -3676,93 +4075,6 @@ html[data-theme="custom"] .logs-viewer-timestamp {
     color: inherit;
 }
 
-/* Detached pill options (segmented radio groups rendered as separate pills) */
-.option-pill-group {
-    display: flex;
-    flex-wrap: wrap;
-    gap: 0.5rem;
-}
-
-.option-pill-group label {
-    margin-bottom: 0;
-}
-
-.option-pill {
-    display: inline-flex;
-    align-items: center;
-    justify-content: center;
-    gap: 0.375rem;
-    height: 2rem;
-    padding: 0 0.875rem;
-    border-radius: 8px;
-    border: 1px solid var(--coollabs-line);
-    background: var(--coollabs-elevated);
-    font-size: 0.875rem;
-    font-weight: 500;
-    white-space: nowrap;
-    color: #000000;
-    transition: background-color 0.15s, border-color 0.15s;
-}
-
-.dark .option-pill {
-    color: var(--color-fg);
-}
-
-.option-pill:hover {
-    background: var(--coollabs-recessed);
-}
-
-.peer:checked + .option-pill {
-    background: var(--coollabs-fill);
-    border-color: var(--coollabs-line);
-}
-
-.peer:disabled + .option-pill {
-    cursor: not-allowed;
-    opacity: 0.5;
-}
-
-/* Label column + content rows inside a card body */
-.application-purpose-row {
-    display: grid;
-    gap: 1rem;
-    border-top: 1px solid var(--coollabs-fill);
-    padding-top: 1.25rem;
-}
-
-@media (min-width: 768px) {
-    .application-purpose-row {
-        grid-template-columns: 13rem minmax(0, 1fr);
-        gap: 2rem;
-    }
-}
-
-.application-purpose-copy h4 {
-    font-size: 0.875rem;
-    font-weight: 600;
-    color: #000000;
-}
-
-.dark .application-purpose-copy h4 {
-    color: var(--color-fg);
-}
-
-.application-purpose-copy p {
-    margin-top: 0.25rem;
-    font-size: 0.875rem;
-    line-height: 1.25rem;
-    color: #71717a;
-}
-
-.dark .application-purpose-copy p {
-    color: var(--color-fg-dim);
-}
-
-.application-details-card .application-purpose-row {
-    grid-template-columns: minmax(0, 1fr);
-    gap: 1rem;
-}
-
 /* In-card sub-headings (e.g. "Container labels", "Docker Compose") */
 .application-settings-form h4,
 .application-settings-form .application-settings-section-body h3 {
@@ -3919,7 +4231,7 @@ html[data-theme="custom"] .logs-viewer-timestamp {
     overflow: hidden;
     border-radius: 10px;
     background: var(--coollabs-elevated);
-    box-shadow: 0 0 0 1px var(--coollabs-hairline), var(--shadow-modal);
+    box-shadow: 0 0 0 1px var(--coollabs-hairline), var(--shadow-dropdown);
 }
 
 .command-palette-header {
@@ -4393,3 +4705,122 @@ a.command-palette-item:focus-visible {
 .dark .command-palette-arch-badge {
     color: #fcd34d;
 }
+
+/* Service domains prioritize public addresses; configuration lives in settings. */
+#service-domains-section,
+.domains-overview-container {
+    container: service-domains / inline-size;
+}
+
+.service-domains-overview-grid {
+    grid-template-columns: minmax(0, 1fr) 7.25rem 7.5rem 5.5rem 6.5rem 8rem 6.5rem;
+    column-gap: 0.75rem;
+}
+
+.data-table-row.service-domains-overview-grid {
+    padding-block: 0.5rem;
+}
+
+.service-domain-detail {
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    min-width: 0;
+    font-size: 12px;
+}
+
+.service-domains-overview-grid > span:not(:first-child):not(:last-child) {
+    text-align: center;
+}
+
+.service-domain-detail-label {
+    display: none;
+}
+
+.service-domain-mobile-summary {
+    display: none;
+}
+
+.service-domains-https .listbox-trigger {
+    min-width: 7rem;
+}
+
+@container service-domains (max-width: 980px) {
+    .data-table-header.service-domains-overview-grid {
+        display: none;
+    }
+
+    .data-table-row.service-domains-overview-grid {
+        grid-template-columns: repeat(2, minmax(0, 1fr));
+        gap: 0.75rem;
+    }
+
+    .data-table-row.service-domains-overview-grid > :first-child {
+        grid-column: 1 / -1;
+    }
+
+    .service-domain-detail {
+        justify-content: space-between;
+        gap: 0.5rem;
+    }
+
+    .service-domain-detail-label {
+        display: inline;
+        color: var(--coollabs-fg-dim);
+    }
+}
+
+@container service-domains (max-width: 600px) {
+    .data-table-row.service-domains-overview-grid {
+        grid-template-columns: minmax(0, 1fr) auto;
+        gap: 0.625rem 0.75rem;
+        padding: 0.875rem;
+    }
+
+    .data-table-row.service-domains-overview-grid > :first-child {
+        grid-column: 1 / -1;
+    }
+
+    .data-table-row.service-domains-overview-grid > :first-child a,
+    .data-table-row.service-domains-overview-grid > :first-child span[title] {
+        overflow: visible;
+        white-space: normal;
+        overflow-wrap: anywhere;
+        line-height: 1.35;
+    }
+
+    .service-domain-detail,
+    .domains-service-desktop {
+        display: none;
+    }
+
+    .service-domain-mobile-summary {
+        display: flex;
+        grid-column: 1 / -1;
+        flex-wrap: wrap;
+        align-items: center;
+        gap: 0.375rem 0.75rem;
+        color: var(--coollabs-fg-dim);
+        font-size: 12px;
+        line-height: 1.25rem;
+    }
+
+    .service-domain-mobile-summary > span:not(:last-child)::after {
+        margin-left: 0.75rem;
+        color: var(--coollabs-line);
+        content: "·";
+    }
+
+    .service-domain-dns {
+        justify-self: start;
+    }
+
+    .service-domain-actions {
+        justify-self: end;
+    }
+
+    .service-domain-actions .icon-button {
+        width: 2.5rem;
+        height: 2.5rem;
+    }
+}
diff --git a/resources/css/utilities.css b/resources/css/utilities.css
index 6fdd260b5f..297a5acc42 100644
--- a/resources/css/utilities.css
+++ b/resources/css/utilities.css
@@ -15,7 +15,7 @@
 }
 
 @utility apexcharts-tooltip-custom {
-    @apply bg-white dark:bg-coolgray-100 border border-neutral-200 dark:border-coolgray-300 rounded-lg shadow-lg p-3 text-sm;
+    @apply bg-white dark:bg-coolgray-100 border border-neutral-200 dark:border-coolgray-300 rounded-lg shadow-dropdown p-3 text-sm;
     min-width: 160px;
 }
 
@@ -59,7 +59,7 @@
 
 /*  input, select before */
 @utility input-select {
-    @apply block h-9 px-3 py-1.5 w-full text-sm text-black rounded-md border border-neutral-200 bg-white dark:bg-surface dark:text-fg dark:border-white/[0.08] transition-colors disabled:bg-neutral-100 disabled:text-neutral-400 dark:disabled:bg-white/[0.03] dark:disabled:text-fg-faint;
+    @apply block h-9 px-3 py-1.5 w-full text-sm text-black rounded-md border border-neutral-200 bg-[var(--coollabs-recessed)] dark:text-fg dark:border-white/[0.08] transition-colors disabled:bg-neutral-100 disabled:text-neutral-400 dark:disabled:bg-white/[0.03] dark:disabled:text-fg-faint;
     box-shadow: none;
 
     &:where(.dark, .dark *) {
@@ -77,18 +77,18 @@
 
 /* Readonly */
 @utility input {
-    @apply dark:read-only:text-neutral-500 dark:read-only:bg-coolgray-100/40 placeholder:text-neutral-300 dark:placeholder:text-neutral-700 read-only:text-neutral-500 read-only:bg-neutral-200;
+    @apply dark:read-only:text-neutral-500 dark:read-only:bg-coolgray-100/40 placeholder:text-neutral-400 dark:placeholder:text-neutral-500 read-only:text-neutral-500 read-only:bg-neutral-200;
     @apply input-select;
     @apply focus-visible:outline-none;
 
     &:focus-visible {
         border-color: var(--color-accent);
-        box-shadow: 0 0 0 1px var(--color-accent);
+        box-shadow: none;
     }
 
     &:where(.dark, .dark *):focus-visible {
         border-color: var(--color-accent);
-        box-shadow: 0 0 0 1px var(--color-accent);
+        box-shadow: none;
     }
 
     &:read-only {
@@ -116,17 +116,17 @@
 
     &:focus-visible {
         border-color: var(--color-accent);
-        box-shadow: 0 0 0 1px var(--color-accent);
+        box-shadow: none;
     }
 
     &:where(.dark, .dark *):focus-visible {
         border-color: var(--color-accent);
-        box-shadow: 0 0 0 1px var(--color-accent);
+        box-shadow: none;
     }
 }
 
 @utility button {
-    @apply inline-flex shrink-0 gap-1.5 justify-center items-center whitespace-nowrap px-2.5 h-8 min-h-8 text-[13px] text-black normal-case rounded-md border outline-0 cursor-pointer font-medium transition-colors bg-white border-neutral-200 hover:bg-neutral-100 dark:bg-white/[0.06] dark:text-fg dark:hover:text-fg dark:hover:bg-white/[0.1] dark:border-white/[0.08] hover:text-black disabled:cursor-not-allowed min-w-fit dark:disabled:text-fg-faint disabled:border-neutral-200 dark:disabled:border-white/[0.06] disabled:hover:bg-transparent disabled:bg-transparent disabled:text-neutral-300 focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-accent;
+    @apply inline-flex shrink-0 gap-1.5 justify-center items-center whitespace-nowrap px-2.5 h-8 min-h-8 text-[13px] text-black capitalize rounded-md border outline-0 cursor-pointer font-medium transition-colors bg-white border-neutral-200 hover:bg-neutral-100 dark:bg-white/[0.06] dark:text-fg dark:hover:text-fg dark:hover:bg-white/[0.1] dark:border-white/[0.08] hover:text-black disabled:cursor-not-allowed min-w-fit dark:disabled:text-fg-faint disabled:border-neutral-200 dark:disabled:border-white/[0.06] disabled:hover:bg-transparent disabled:bg-transparent disabled:text-neutral-300 focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-accent;
 }
 
 @utility button-highlighted {
@@ -162,7 +162,7 @@
 }
 
 @utility auth-tooltip {
-    @apply fixed z-[10000] px-2.5 py-1.5 text-xs font-medium rounded-lg pointer-events-none whitespace-nowrap text-white bg-neutral-900 border border-neutral-700 shadow-lg dark:text-fg dark:bg-raised dark:border-white/10;
+    @apply fixed z-[10000] px-2.5 py-1.5 text-xs font-medium rounded-lg pointer-events-none whitespace-nowrap text-white bg-neutral-900 border border-neutral-700 shadow-dropdown dark:text-fg dark:bg-raised dark:border-white/10;
 }
 
 @utility alert-success {
@@ -222,7 +222,10 @@
 }
 
 @utility menu-item {
-    @apply relative flex gap-2.5 items-center h-8 px-2.5 w-full text-[13px] font-medium rounded-md truncate min-w-0 transition-colors text-nav-text hover:bg-neutral-100 hover:text-nav-active dark:hover:bg-white/[0.05];
+    /* Translucent hover (like the active pill) so it darkens against any surface,
+       including the light-mode settings rail's gray fill; on white it matches the
+       old neutral-100. */
+    @apply relative flex gap-2.5 items-center h-8 px-2.5 w-full text-[13px] font-medium rounded-md truncate min-w-0 transition-colors text-nav-text hover:bg-black/[0.04] hover:text-nav-active dark:hover:bg-white/[0.05];
 }
 @utility menu-item-icon {
     @apply shrink-0 size-[18px] opacity-90;
@@ -245,7 +248,7 @@
 /* Indented child rows in a collapsible nav group */
 @utility menu-subitem {
     /* Label owns text ellipsis; keep this row overflow-visible so the focus ring is not clipped. */
-    @apply relative flex gap-2.5 items-center h-8 pl-3 pr-2.5 w-full text-[13px] font-medium rounded-md min-w-0 transition-colors text-nav-text hover:bg-neutral-100 hover:text-nav-active dark:hover:bg-white/[0.05];
+    @apply relative flex gap-2.5 items-center h-8 pl-3 pr-2.5 w-full text-[13px] font-medium rounded-md min-w-0 transition-colors text-nav-text hover:bg-black/[0.04] hover:text-nav-active dark:hover:bg-white/[0.05];
 }
 @utility menu-subitem-active {
     @apply rounded-md bg-black/[0.05] text-nav-active hover:bg-black/[0.05] dark:bg-white/[0.06] dark:hover:bg-white/[0.06];
@@ -344,7 +347,7 @@
 }
 
 @utility info-helper-popup {
-    @apply rounded-lg border border-neutral-200 bg-white text-neutral-600 shadow-modal whitespace-normal break-words dark:border-white/10 dark:bg-raised dark:text-fg-dim;
+    @apply rounded-lg border border-neutral-200 bg-white text-neutral-600 shadow-dropdown whitespace-normal break-words dark:border-white/10 dark:bg-raised dark:text-fg-dim;
 }
 
 @utility buyme {
@@ -367,6 +370,14 @@
     @apply z-[1];
 }
 
+/* Floating notice / popover surface: elevated fill, hairline ring, and the
+   shared dropdown lift. Toasts, change-pending popovers and the deployments
+   list share this so they match menus/dropdowns instead of the heavier modal. */
+@utility surface-popover {
+    background: var(--coollabs-elevated);
+    box-shadow: 0 0 0 1px var(--coollabs-line), var(--shadow-dropdown);
+}
+
 @utility dz-button {
     @apply p-4 py-10 my-4 w-full font-bold bg-white border dark:border-coolgray-400 dark:text-white dark:bg-transparent dark:hover:bg-coolgray-400;
 }
diff --git a/resources/js/app.js b/resources/js/app.js
index 11681efa03..10d3c2d01c 100644
--- a/resources/js/app.js
+++ b/resources/js/app.js
@@ -124,3 +124,16 @@ window.scrollToSettingsSection = function scrollToSettingsSection(id) {
 
     rafId = window.requestAnimationFrame(tick);
 };
+
+// When a settings sub-section link navigates across pages (href="route#section-id"),
+// scroll to that section once the destination page has rendered.
+function scrollToHashSettingsSection() {
+    const hash = window.location.hash;
+    if (!hash || hash.length < 2) {
+        return;
+    }
+    const id = decodeURIComponent(hash.slice(1));
+    window.requestAnimationFrame(() => window.scrollToSettingsSection?.(id));
+}
+document.addEventListener('livewire:navigated', scrollToHashSettingsSection);
+document.addEventListener('DOMContentLoaded', scrollToHashSettingsSection);
diff --git a/resources/views/auth/two-factor-challenge.blade.php b/resources/views/auth/two-factor-challenge.blade.php
index b15afc24de..10480b9204 100644
--- a/resources/views/auth/two-factor-challenge.blade.php
+++ b/resources/views/auth/two-factor-challenge.blade.php
@@ -2,6 +2,14 @@
     <x-auth.shell title="Coolify" description="Verify your identity to finish signing in.">
         <div class="flex flex-col gap-4" x-data="{
             showRecovery: false,
+            submitting: false,
+            handleSubmit(event) {
+                if (this.submitting) {
+                    event.preventDefault();
+                }
+
+                this.submitting = true;
+            },
             submitAuthenticatorCode(event) {
                 event.target.value = event.target.value.replace(/\D/g, '').slice(0, 6);
 
@@ -30,7 +38,8 @@
                 <p x-show="showRecovery" x-cloak>Enter one of the recovery codes you saved when setting up two-factor authentication.</p>
             </div>
 
-            <form x-ref="challengeForm" action="/two-factor-challenge" method="POST" class="flex flex-col gap-4">
+            <form x-ref="challengeForm" action="/two-factor-challenge" method="POST" class="flex flex-col gap-4"
+                @submit="handleSubmit($event)">
                 @csrf
 
                 <div x-show="!showRecovery" class="flex flex-col gap-3">
@@ -54,7 +63,7 @@
                     </button>
                 </div>
 
-                <x-forms.button class="w-full justify-center" type="submit" isHighlighted>
+                <x-forms.button class="w-full justify-center" type="submit" x-bind:disabled="submitting" isHighlighted>
                     Verify and continue
                 </x-forms.button>
             </form>
diff --git a/resources/views/components/application/configuration-sidebar.blade.php b/resources/views/components/application/configuration-sidebar.blade.php
index 774bc49f0a..369d498c96 100644
--- a/resources/views/components/application/configuration-sidebar.blade.php
+++ b/resources/views/components/application/configuration-sidebar.blade.php
@@ -238,52 +238,104 @@
         ];
     @endphp
 
+@php
+    $activeMenuLabel = collect($groupedMenuItems)->flatMap(fn ($items) => $items)->firstWhere('active', true)['label'] ?? 'Settings';
+@endphp
 <aside @class([
     'application-settings-navigation min-w-0 xl:self-start',
     'is-flush' => $flush,
-])>
-                <nav aria-label="Configuration sections"
-                    class="grid grid-cols-2 gap-0.5 border-y border-neutral-200 py-3 sm:grid-cols-3 lg:grid-cols-4 xl:grid-cols-1 xl:border-y-0 xl:py-0 dark:border-white/[0.06]">
+])
+    x-data="{
+        menuOpen: false,
+        desktop: window.matchMedia('(min-width: 1280px)').matches,
+        init() {
+            const mq = window.matchMedia('(min-width: 1280px)');
+            mq.addEventListener('change', (e) => { this.desktop = e.matches; if (e.matches) { this.menuOpen = false; } });
+        },
+    }"
+    x-on:click.outside="menuOpen = false"
+    x-on:keydown.escape.window="menuOpen = false">
+                {{-- Mobile disclosure: tap to reveal the full grouped nav; hidden at xl (the pinned rail). --}}
+                <button type="button" x-show="!desktop" x-cloak x-on:click="menuOpen = !menuOpen"
+                    :aria-expanded="menuOpen" aria-label="Configuration menu"
+                    :class="menuOpen && 'ring-1 ring-black/10 dark:ring-white/15'"
+                    class="flex h-10 w-full items-center justify-between gap-2 rounded-xl border border-neutral-200 bg-white px-3 text-[13px] font-medium text-black transition-transform duration-100 ease-out hover:bg-neutral-50 active:scale-[0.985] dark:border-white/[0.08] dark:bg-white/[0.05] dark:text-fg dark:hover:bg-white/[0.08]">
+                    <span class="flex min-w-0 items-center gap-2">
+                        <x-reicon name="settings" class="size-4 shrink-0 text-nav-muted" />
+                        <span class="truncate">{{ $activeMenuLabel }}</span>
+                    </span>
+                    <svg class="size-3.5 shrink-0 text-nav-muted transition-transform duration-200 ease-[cubic-bezier(0.23,1,0.32,1)]"
+                        :class="menuOpen && 'rotate-180'" viewBox="0 0 12 12" fill="none" aria-hidden="true">
+                        <path d="m3.5 4.75 2.5 2.5 2.5-2.5" stroke="currentColor" stroke-width="1.25"
+                            stroke-linecap="round" stroke-linejoin="round" />
+                    </svg>
+                </button>
+
+                <nav aria-label="Configuration sections" x-show="desktop || menuOpen" x-collapse.duration.200ms x-cloak
+                    class="mt-2 flex flex-col gap-0.5 rounded-xl border border-neutral-200 bg-white p-2 shadow-[var(--shadow-dropdown)] dark:border-white/[0.08] dark:bg-white/[0.03] xl:mt-0 xl:rounded-none xl:border-0 xl:bg-transparent xl:p-0 xl:shadow-none xl:dark:bg-transparent">
                     @foreach ($groupedMenuItems as $groupLabel => $groupItems)
                         @unless ($loop->first)
-                            <div class="hidden xl:block my-2 border-t border-neutral-200 dark:border-white/[0.06]" aria-hidden="true"></div>
+                            <div class="my-2 border-t border-neutral-200 dark:border-white/[0.06]" aria-hidden="true"></div>
                         @endunless
-                        <div class="nav-section hidden xl:block">{{ $groupLabel }}</div>
+                        <div class="nav-section">{{ $groupLabel }}</div>
                         @foreach ($groupItems as $menuItem)
-                            <a wire:key="application-settings-link-{{ str($menuItem['label'])->slug() }}"
-                                @class([
-                                    'menu-item',
-                                    'menu-item-active' => $menuItem['active'],
-                                ])
-                        @if ($menuItem['navigate'] ?? true) {{ wireNavigate() }} @endif
-                                href="{{ route($menuItem['route'], $applicationRouteParameters) }}">
-                                <x-reicon :name="$menuIcons[$menuItem['label']] ?? 'settings'" class="menu-item-icon" />
-                                <span class="menu-item-label">{{ $menuItem['label'] }}</span>
-                                @if ($menuItem['badge'] ?? false)
-                                    <span class="shrink-0">
-                                        <livewire:project.application.server-status-badge :application="$application"
-                                            :key="'application-server-status-'.$application->uuid" />
-                                    </span>
+                            @php $sections = $pageSections[$menuItem['route']] ?? []; @endphp
+                            <div wire:key="application-settings-group-{{ str($menuItem['label'])->slug() }}"
+                                @if (filled($sections)) x-data="{ open: @js($menuItem['active']), activeSection: '' }" @endif
+                                class="relative">
+                                <a wire:key="application-settings-link-{{ str($menuItem['label'])->slug() }}"
+                                    @class([
+                                        'menu-item',
+                                        'menu-item-active' => $menuItem['active'],
+                                        'pr-9' => filled($sections),
+                                    ])
+                            @if ($menuItem['navigate'] ?? true) {{ wireNavigate() }} @endif
+                                    href="{{ route($menuItem['route'], $applicationRouteParameters) }}"
+                                    x-on:click="menuOpen = false">
+                                    <x-reicon :name="$menuIcons[$menuItem['label']] ?? 'settings'" class="menu-item-icon" />
+                                    <span class="menu-item-label">{{ $menuItem['label'] }}</span>
+                                    @if ($menuItem['badge'] ?? false)
+                                        <span class="shrink-0">
+                                            <livewire:project.application.server-status-badge :application="$application"
+                                                :key="'application-server-status-'.$application->uuid" />
+                                        </span>
+                                    @endif
+                                </a>
+                                @if (filled($sections))
+                                    {{-- Expand/collapse the page's sub-sections. Active page opens by
+                                         default; the label still navigates, the chevron only toggles. --}}
+                                    <button type="button"
+                                        class="absolute right-1 top-1 flex size-6 items-center justify-center rounded-md text-nav-muted transition-colors hover:bg-black/[0.04] hover:text-nav-active dark:hover:bg-white/[0.06]"
+                                        x-on:click.stop.prevent="open = !open" :aria-expanded="open"
+                                        aria-label="Toggle {{ $menuItem['label'] }} sections">
+                                        <svg class="size-3.5 transition-transform duration-200 ease-[cubic-bezier(0.23,1,0.32,1)]"
+                                            :class="open && 'rotate-90'" viewBox="0 0 12 12" fill="none" aria-hidden="true">
+                                            <path d="m4.5 3 3 3-3 3" stroke="currentColor" stroke-width="1.25"
+                                                stroke-linecap="round" stroke-linejoin="round" />
+                                        </svg>
+                                    </button>
+                                    <div>
+                                        <div x-show="open" x-collapse.duration.200ms x-cloak
+                                            class="nav-children flex flex-col gap-0.5 py-1">
+                                            @foreach ($sections as $section)
+                                                @if ($menuItem['active'])
+                                                    <button type="button" class="menu-subitem"
+                                                        :class="activeSection === '{{ $section['id'] }}' && 'menu-subitem-active'"
+                                                        x-on:click="menuOpen = false; activeSection = '{{ $section['id'] }}'; history.replaceState(null, '', '#{{ $section['id'] }}'); window.scrollToSettingsSection?.('{{ $section['id'] }}')">
+                                                        <span class="menu-item-label text-left">{{ $section['label'] }}</span>
+                                                    </button>
+                                                @else
+                                                    <a class="menu-subitem"
+                                                        href="{{ route($menuItem['route'], $applicationRouteParameters) }}#{{ $section['id'] }}"
+                                                        {{ wireNavigate() }} x-on:click="menuOpen = false">
+                                                        <span class="menu-item-label text-left">{{ $section['label'] }}</span>
+                                                    </a>
+                                                @endif
+                                            @endforeach
+                                        </div>
+                                    </div>
                                 @endif
-                            </a>
-                            @if ($menuItem['active'] && count($pageSections[$menuItem['route']] ?? []) >= 4)
-                                <div class="nav-children hidden flex-col gap-0.5 py-1 xl:flex"
-                                    x-data="{
-                                        activeSection: '',
-                                        scrollToSection(id) {
-                                            this.activeSection = id;
-                                            window.scrollToSettingsSection?.(id);
-                                        },
-                                    }">
-                                    @foreach ($pageSections[$menuItem['route']] as $section)
-                                        <button type="button" class="menu-subitem"
-                                            :class="activeSection === '{{ $section['id'] }}' && 'menu-subitem-active'"
-                                            @click="scrollToSection('{{ $section['id'] }}')">
-                                            <span class="menu-item-label text-left">{{ $section['label'] }}</span>
-                                        </button>
-                                    @endforeach
-                                </div>
-                            @endif
+                            </div>
                         @endforeach
                     @endforeach
                 </nav>
diff --git a/resources/views/components/boarding-progress.blade.php b/resources/views/components/boarding-progress.blade.php
index e19bddb9ec..b342d2de22 100644
--- a/resources/views/components/boarding-progress.blade.php
+++ b/resources/views/components/boarding-progress.blade.php
@@ -2,7 +2,7 @@
 
 <div class="mx-auto mb-6 w-full max-w-3xl">
     <div
-        class="grid grid-cols-3 overflow-hidden rounded-[10px] border border-neutral-200 bg-white dark:border-white/[0.08] dark:bg-white/[0.025]">
+        class="grid grid-cols-3 overflow-hidden rounded-[10px] border border-neutral-200 bg-white dark:border-white/[0.08] dark:bg-white/[0.05]">
         @for ($i = 1; $i <= $totalSteps; $i++)
             <div @class([
                 'flex min-h-10 items-center justify-center gap-2 border-r border-neutral-200 px-3 text-[11px] font-medium last:border-r-0 dark:border-white/[0.08]',
diff --git a/resources/views/components/configuration-warning.blade.php b/resources/views/components/configuration-warning.blade.php
index 11f2f86a59..50a84d2cb2 100644
--- a/resources/views/components/configuration-warning.blade.php
+++ b/resources/views/components/configuration-warning.blade.php
@@ -9,8 +9,7 @@
     </button>
 
     <div x-show="open" x-cloak x-transition.opacity role="dialog"
-        class="fixed top-14 left-1/2 z-[1100] w-[calc(100vw-2rem)] max-w-sm -translate-x-1/2 rounded-lg p-3 lg:absolute lg:top-full lg:right-0 lg:left-auto lg:mt-2 lg:translate-x-0"
-        style="background: var(--coollabs-elevated); box-shadow: 0 0 0 1px var(--coollabs-line), var(--shadow-modal);">
+        class="surface-popover fixed top-14 left-1/2 z-[1100] w-[calc(100vw-2rem)] max-w-sm -translate-x-1/2 rounded-lg p-3 lg:absolute lg:top-full lg:right-0 lg:left-auto lg:mt-2 lg:translate-x-0">
         <div class="flex items-start gap-2.5">
             <span
                 class="flex size-7 shrink-0 items-center justify-center rounded-md bg-amber-100 text-amber-700 dark:bg-warning/10 dark:text-warning">
diff --git a/resources/views/components/dropdown.blade.php b/resources/views/components/dropdown.blade.php
index b48b041439..e6d4c0af5d 100644
--- a/resources/views/components/dropdown.blade.php
+++ b/resources/views/components/dropdown.blade.php
@@ -60,15 +60,21 @@
         </svg>
     </button>
 
-    <div x-ref="panel" x-show="dropdownOpen" @click.away="if (! {{ $inline ? 'true' : 'false' }}) close()" x-transition:enter="ease-out duration-200"
-        x-transition:enter-start="-translate-y-2" x-transition:enter-end="translate-y-0"
+    <div x-ref="panel" x-show="dropdownOpen" @click.away="if (! {{ $inline ? 'true' : 'false' }}) close()"
+        x-transition:enter="transition ease-out duration-150"
+        x-transition:enter-start="opacity-0 -translate-y-1 scale-[0.98]"
+        x-transition:enter-end="opacity-100 translate-y-0 scale-100"
+        x-transition:leave="transition ease-in duration-100"
+        x-transition:leave-start="opacity-100 translate-y-0 scale-100"
+        x-transition:leave-end="opacity-0 -translate-y-1 scale-[0.98]"
         :style="panelStyles" @class([
+            'origin-top' => true,
             'mt-1 w-full' => $inline,
             'absolute top-full z-50 mt-1 min-w-max max-w-[calc(100vw-1rem)] md:top-0 md:mt-6' => ! $inline,
         ]) x-cloak>
         <div @class([
             'border border-neutral-300 bg-white p-1 dark:border-coolgray-300',
-            'shadow-sm dark:bg-coolgray-200' => ! $inline,
+            'shadow-[var(--shadow-dropdown)] dark:bg-coolgray-200' => ! $inline,
             'border-0 bg-transparent shadow-none dark:border-0 dark:bg-transparent' => $inline,
             $panelClass,
         ])>
diff --git a/resources/views/components/forms/button.blade.php b/resources/views/components/forms/button.blade.php
index 7a061dc45e..ccf0dc55a4 100644
--- a/resources/views/components/forms/button.blade.php
+++ b/resources/views/components/forms/button.blade.php
@@ -80,6 +80,10 @@
 </button>
 @if ($authDisabled || filled($tooltip))
     <div x-ref="tip" x-show="visible" x-cloak :id="$id('button-tooltip')" role="tooltip"
+        x-transition:enter="transition-opacity ease-out duration-100"
+        x-transition:enter-start="opacity-0" x-transition:enter-end="opacity-100"
+        x-transition:leave="transition-opacity ease-in duration-75"
+        x-transition:leave-start="opacity-100" x-transition:leave-end="opacity-0"
         class="auth-tooltip">
         {{ $tooltip ?: 'You do not have permission to perform this action.' }}
     </div>
diff --git a/resources/views/components/forms/checkbox.blade.php b/resources/views/components/forms/checkbox.blade.php
index 20e090f92b..5a04b99986 100644
--- a/resources/views/components/forms/checkbox.blade.php
+++ b/resources/views/components/forms/checkbox.blade.php
@@ -49,7 +49,7 @@
             @endif
 
             <span
-                class="pointer-events-none absolute inset-0 rounded-[5px] border border-neutral-300 bg-white shadow-[inset_0_1px_1px_rgb(0_0_0/0.04)] transition-colors group-hover:border-neutral-400 peer-checked:border-coollabs peer-checked:bg-coollabs peer-focus-visible:ring-2 peer-focus-visible:ring-coollabs/25 peer-focus-visible:ring-offset-2 peer-disabled:opacity-50 dark:border-white/[0.14] dark:bg-white/[0.045] dark:shadow-none dark:group-hover:border-white/[0.22] dark:peer-checked:border-warning dark:peer-checked:bg-warning dark:peer-focus-visible:ring-warning/30 dark:peer-focus-visible:ring-offset-base"></span>
+                class="pointer-events-none absolute inset-0 rounded-[5px] border border-neutral-300 bg-white shadow-[inset_0_1px_1px_rgb(0_0_0/0.04)] transition-[color,background-color,border-color,box-shadow] duration-150 ease-out group-hover:border-neutral-400 peer-checked:border-coollabs peer-checked:bg-coollabs peer-focus-visible:ring-2 peer-focus-visible:ring-coollabs/25 peer-focus-visible:ring-offset-2 peer-disabled:opacity-50 dark:border-white/[0.14] dark:bg-white/[0.045] dark:shadow-none dark:group-hover:border-white/[0.22] dark:peer-checked:border-warning dark:peer-checked:bg-warning dark:peer-focus-visible:ring-warning/30 dark:peer-focus-visible:ring-offset-base"></span>
             <svg class="pointer-events-none absolute inset-0 m-auto size-3 scale-75 text-white opacity-0 transition-[opacity,transform] peer-checked:scale-100 peer-checked:opacity-100 dark:text-black"
                 viewBox="0 0 12 12" fill="none" aria-hidden="true">
                 <path d="m2.25 6.15 2.35 2.3 5.15-5" stroke="currentColor" stroke-width="1.8"
diff --git a/resources/views/components/forms/datalist.blade.php b/resources/views/components/forms/datalist.blade.php
index 2572daf124..76e46b70ae 100644
--- a/resources/views/components/forms/datalist.blade.php
+++ b/resources/views/components/forms/datalist.blade.php
@@ -132,7 +132,7 @@
 
             {{-- Dropdown Options --}}
             <div x-show="open && !{{ $disabled ? 'true' : 'false' }}" x-transition
-                class="absolute z-50 w-full mt-1 bg-white dark:bg-coolgray-100 border border-neutral-300 dark:border-coolgray-400 rounded shadow-lg max-h-60 overflow-auto scrollbar">
+                class="absolute z-50 w-full mt-1 bg-white dark:bg-coolgray-100 border border-neutral-300 dark:border-coolgray-400 rounded shadow-dropdown max-h-60 overflow-auto scrollbar">
 
                 <template x-if="filteredOptions.length === 0">
                     <div class="px-3 py-2 text-sm text-neutral-500 dark:text-neutral-400">
@@ -277,7 +277,7 @@
 
                 {{-- Dropdown Options --}}
                 <div x-show="open && !{{ $disabled ? 'true' : 'false' }}" x-transition
-                    class="absolute z-50 w-full mt-1 bg-white dark:bg-coolgray-100 border border-neutral-300 dark:border-coolgray-400 rounded shadow-lg max-h-60 overflow-auto scrollbar">
+                    class="absolute z-50 w-full mt-1 bg-white dark:bg-coolgray-100 border border-neutral-300 dark:border-coolgray-400 rounded shadow-dropdown max-h-60 overflow-auto scrollbar">
 
                     <template x-if="filteredOptions.length === 0">
                         <div class="px-3 py-2 text-sm text-neutral-500 dark:text-neutral-400">
diff --git a/resources/views/components/forms/listbox.blade.php b/resources/views/components/forms/listbox.blade.php
index d04a5f57e5..4c572596d6 100644
--- a/resources/views/components/forms/listbox.blade.php
+++ b/resources/views/components/forms/listbox.blade.php
@@ -123,7 +123,8 @@
         {{ $attributes->whereStartsWith('x-model') }}
         {{ $attributes->whereStartsWith('x-effect') }}
         @if ($preserveValue) wire:ignore @endif
-        @click.outside="open = false" @keydown.escape="open = false" @resize.window="open && positionPanel()">
+        @click.outside="open = false" @keydown.escape="open = false" @resize.window="open && positionPanel()"
+        @scroll.window.capture="open && positionPanel()">
         <button x-ref="trigger" id="{{ $triggerId }}" type="button" class="listbox-trigger" @click="toggle()"
             @disabled($disabled) {{ $attributes->whereStartsWith('x-bind:disabled') }} aria-haspopup="listbox"
             :aria-expanded="open" @if ($tooltip) :title="current" @endif>
@@ -134,33 +135,35 @@
             </svg>
         </button>
         @if ($portal)
-            <div id="{{ $panelId }}" class="listbox-panel"
-                style="position: fixed; z-index: 9999; visibility: hidden" x-show="open"
-                x-cloak :style="{ visibility: positioned ? 'visible' : 'hidden' }"
-                x-transition:enter="transition ease-out duration-100"
-                x-transition:enter-start="opacity-0 -translate-y-1 scale-[0.98]"
-                x-transition:enter-end="opacity-100 translate-y-0 scale-100"
-                x-transition:leave="transition ease-in duration-75"
-                x-transition:leave-start="opacity-100 translate-y-0 scale-100"
-                x-transition:leave-end="opacity-0 -translate-y-1 scale-[0.98]"
-                x-effect="if (open) requestAnimationFrame(() => positionPanel($el))" role="listbox">
-                <div x-show="options.length === 0"
-                    class="px-3 py-2 text-[13px] text-neutral-500 dark:text-fg-dim">
-                    {{ $emptyText }}
+            <template x-teleport="body">
+                <div id="{{ $panelId }}" class="listbox-panel"
+                    style="position: fixed; z-index: 9999; visibility: hidden" x-show="open"
+                    x-cloak :style="{ visibility: positioned ? 'visible' : 'hidden' }"
+                    x-transition:enter="transition ease-out duration-100"
+                    x-transition:enter-start="opacity-0 -translate-y-1 scale-[0.98]"
+                    x-transition:enter-end="opacity-100 translate-y-0 scale-100"
+                    x-transition:leave="transition ease-in duration-75"
+                    x-transition:leave-start="opacity-100 translate-y-0 scale-100"
+                    x-transition:leave-end="opacity-0 -translate-y-1 scale-[0.98]"
+                    x-effect="if (open) requestAnimationFrame(() => positionPanel($el))" role="listbox">
+                    <div x-show="options.length === 0"
+                        class="px-3 py-2 text-[13px] text-neutral-500 dark:text-fg-dim">
+                        {{ $emptyText }}
+                    </div>
+                    <template x-for="option in options" :key="String(option.value)">
+                        <button type="button" class="listbox-option" role="option"
+                            :class="{ 'listbox-option-disabled': option.disabled }"
+                            :aria-selected="String(option.value) === String(value)" @click="choose(option)">
+                            <span class="truncate" x-text="option.label"></span>
+                            <svg x-show="String(option.value) === String(value)" xmlns="http://www.w3.org/2000/svg"
+                                fill="none" viewBox="0 0 24 24" stroke-width="2.5" stroke="currentColor"
+                                class="size-3.5 shrink-0">
+                                <path stroke-linecap="round" stroke-linejoin="round" d="m4.5 12.75 6 6 9-13.5" />
+                            </svg>
+                        </button>
+                    </template>
                 </div>
-                <template x-for="option in options" :key="String(option.value)">
-                    <button type="button" class="listbox-option" role="option"
-                        :class="{ 'listbox-option-disabled': option.disabled }"
-                        :aria-selected="String(option.value) === String(value)" @click="choose(option)">
-                        <span class="truncate" x-text="option.label"></span>
-                        <svg x-show="String(option.value) === String(value)" xmlns="http://www.w3.org/2000/svg"
-                            fill="none" viewBox="0 0 24 24" stroke-width="2.5" stroke="currentColor"
-                            class="size-3.5 shrink-0">
-                            <path stroke-linecap="round" stroke-linejoin="round" d="m4.5 12.75 6 6 9-13.5" />
-                        </svg>
-                    </button>
-                </template>
-            </div>
+            </template>
         @else
             <div x-ref="panel" class="listbox-panel" x-show="open" x-cloak
                 x-transition:enter="transition ease-out duration-100"
diff --git a/resources/views/components/icon-tooltip.blade.php b/resources/views/components/icon-tooltip.blade.php
index de62e8813d..8a43e02ea1 100644
--- a/resources/views/components/icon-tooltip.blade.php
+++ b/resources/views/components/icon-tooltip.blade.php
@@ -69,8 +69,12 @@
     },
 }" class="contents">
     <div x-ref="tooltip" x-show="visible" x-cloak role="tooltip" x-text="text"
+        x-transition:enter="transition-opacity ease-out duration-100"
+        x-transition:enter-start="opacity-0" x-transition:enter-end="opacity-100"
+        x-transition:leave="transition-opacity ease-in duration-75"
+        x-transition:leave-start="opacity-100" x-transition:leave-end="opacity-0"
         :style="`left: ${x}px; top: ${y}px;`"
         :class="[below ? '' : '-translate-y-full', positioned ? 'visible' : 'invisible']"
-        class="pointer-events-none fixed z-[10000] whitespace-nowrap rounded-lg border border-neutral-700 bg-neutral-900 px-2 py-1 text-xs font-medium text-white shadow-lg dark:border-white/10 dark:bg-raised">
+        class="pointer-events-none fixed z-[10000] whitespace-nowrap rounded-lg border border-neutral-700 bg-neutral-900 px-2 py-1 text-xs font-medium text-white shadow-dropdown dark:border-white/10 dark:bg-raised">
     </div>
 </div>
diff --git a/resources/views/components/modal-confirmation.blade.php b/resources/views/components/modal-confirmation.blade.php
index d63c1953f2..d16bdbe9a1 100644
--- a/resources/views/components/modal-confirmation.blade.php
+++ b/resources/views/components/modal-confirmation.blade.php
@@ -211,14 +211,19 @@
     <template x-teleport="body">
         <div x-show="modalOpen"
             class="fixed inset-0 z-99 flex min-h-full items-center justify-center overflow-y-auto p-4" x-cloak>
-            <div x-show="modalOpen" class="absolute inset-0 bg-black/50 backdrop-blur-[2px]">
+            <div x-show="modalOpen" class="absolute inset-0 bg-black/50 backdrop-blur-[2px]"
+                x-transition:enter="transition-opacity ease-out duration-200"
+                x-transition:enter-start="opacity-0" x-transition:enter-end="opacity-100"
+                x-transition:leave="transition-opacity ease-in duration-150"
+                x-transition:leave-start="opacity-100" x-transition:leave-end="opacity-0">
             </div>
-            <div x-show="modalOpen" x-trap.inert.noscroll="modalOpen" x-transition:enter="ease-out duration-100"
-                x-transition:enter-start="opacity-0 -translate-y-2 sm:scale-95"
-                x-transition:enter-end="opacity-100 translate-y-0 sm:scale-100"
-                x-transition:leave="ease-in duration-100"
-                x-transition:leave-start="opacity-100 translate-y-0 sm:scale-100"
-                x-transition:leave-end="opacity-0 -translate-y-2 sm:scale-95"
+            <div x-show="modalOpen" x-trap.inert.noscroll="modalOpen"
+                x-transition:enter="transition ease-out duration-200"
+                x-transition:enter-start="opacity-0 scale-95"
+                x-transition:enter-end="opacity-100 scale-100"
+                x-transition:leave="transition ease-in duration-150"
+                x-transition:leave-start="opacity-100 scale-100"
+                x-transition:leave-end="opacity-0 scale-95"
                 class="application-settings-form application-settings-section relative flex max-h-[calc(100dvh-2rem)] w-full flex-col lg:min-w-[36rem] lg:max-w-2xl"
                 style="box-shadow: 0 0 0 1px var(--coollabs-hairline), var(--shadow-modal)">
                 <header class="flex-nowrap!">
diff --git a/resources/views/components/modal-input.blade.php b/resources/views/components/modal-input.blade.php
index 588032e039..af21714c4c 100644
--- a/resources/views/components/modal-input.blade.php
+++ b/resources/views/components/modal-input.blade.php
@@ -13,12 +13,9 @@
     'wireOpen' => null,
     'contentClicks' => true,
     'isLarge' => false,
+    'fixedHeight' => false,
 ])
 
-@php
-    $modalId = 'modal-' . uniqid();
-@endphp
-
 <div x-data="{ modalOpen: @if ($wireOpen) $wire.entangle(@js($wireOpen)) @else false @endif }"
     x-init="$watch('modalOpen', value => { if (!value) { $wire.dispatch('modalClosed') } })"
     :class="{ 'z-40': modalOpen }" @keydown.window.escape="modalOpen=false"
@@ -42,23 +39,24 @@
     <template x-teleport="body">
         <div x-show="modalOpen"
             x-init="$watch('modalOpen', value => { if(value) { $nextTick(() => { const firstInput = $el.querySelector('input, textarea, select'); firstInput?.focus(); }) } })"
-            class="fixed inset-0 z-99 overflow-y-auto">
-            <div x-show="modalOpen" x-transition:enter="ease-out duration-100" x-transition:enter-start="opacity-0"
-                x-transition:enter-end="opacity-100" x-transition:leave="ease-in duration-100"
+            class="fixed inset-0 z-99 overflow-hidden">
+            <div x-show="modalOpen" x-transition:enter="transition-opacity ease-out duration-200" x-transition:enter-start="opacity-0"
+                x-transition:enter-end="opacity-100" x-transition:leave="transition-opacity ease-in duration-150"
                 x-transition:leave-start="opacity-100" x-transition:leave-end="opacity-0"
                 class="absolute inset-0 w-full h-full bg-black/50 backdrop-blur-[2px]"></div>
             <div @if ($closeOutside) @click.self="modalOpen=false" @endif class="relative flex min-h-full items-start justify-center p-2 sm:items-center sm:p-4">
-                <div id="{{ $modalId }}" x-show="modalOpen" x-trap.inert.noscroll="modalOpen"
-                    x-transition:enter="ease-out duration-100"
-                    x-transition:enter-start="opacity-0 -translate-y-2 sm:scale-95"
-                    x-transition:enter-end="opacity-100 translate-y-0 sm:scale-100"
-                    x-transition:leave="ease-in duration-100"
-                    x-transition:leave-start="opacity-100 translate-y-0 sm:scale-100"
-                    x-transition:leave-end="opacity-0 -translate-y-2 sm:scale-95"
+                <div x-show="modalOpen" x-trap.inert.noscroll="modalOpen"
+                    x-transition:enter="transition ease-out duration-200"
+                    x-transition:enter-start="opacity-0 scale-95"
+                    x-transition:enter-end="opacity-100 scale-100"
+                    x-transition:leave="transition ease-in duration-150"
+                    x-transition:leave-start="opacity-100 scale-100"
+                    x-transition:leave-end="opacity-0 scale-95"
                     @class([
                         'application-settings-form application-settings-section relative flex max-h-[calc(100dvh-2rem)] w-full flex-col overflow-hidden',
                         'lg:w-[95vw]! lg:max-w-7xl!' => $isLarge,
                         'lg:w-auto lg:min-w-2xl lg:max-w-4xl' => ! $isLarge,
+                        'sm:h-[40rem]' => $fixedHeight,
                     ])
                     style="box-shadow: 0 0 0 1px var(--coollabs-hairline), var(--shadow-modal)">
                     <header class="flex-wrap! sm:flex-nowrap!">
diff --git a/resources/views/components/navbar.blade.php b/resources/views/components/navbar.blade.php
index 80c96f9744..153727e46d 100644
--- a/resources/views/components/navbar.blade.php
+++ b/resources/views/components/navbar.blade.php
@@ -240,6 +240,6 @@
     </div>
     <div x-show="collapsed && tooltip.show" x-cloak x-transition.opacity.duration.100ms
         :style="`left: ${tooltip.x}px; top: ${tooltip.y}px;`"
-        class="fixed z-[10000] -translate-y-1/2 px-2 py-1 text-xs font-medium rounded-lg bg-neutral-900 dark:bg-raised text-white whitespace-nowrap pointer-events-none shadow-lg border border-neutral-700 dark:border-white/10"
+        class="fixed z-[10000] -translate-y-1/2 px-2 py-1 text-xs font-medium rounded-lg bg-neutral-900 dark:bg-raised text-white whitespace-nowrap pointer-events-none shadow-dropdown border border-neutral-700 dark:border-white/10"
         x-text="tooltip.text"></div>
 </nav>
diff --git a/resources/views/components/popup-small.blade.php b/resources/views/components/popup-small.blade.php
index eec0c46c28..80f2b453d5 100644
--- a/resources/views/components/popup-small.blade.php
+++ b/resources/views/components/popup-small.blade.php
@@ -53,8 +53,7 @@
     x-transition:leave-end="translate-y-3 opacity-0"
     class="fixed right-4 z-999 {{ $position === 'top-right' ? 'top-16' : 'bottom-4' }}">
     <template x-if="iconOnly">
-        <button type="button" @click="restore()" aria-label="Restore warning" class="flex rounded-lg p-2"
-            style="background: var(--coollabs-elevated); box-shadow: 0 0 0 1px var(--coollabs-line), var(--shadow-modal);">
+        <button type="button" @click="restore()" aria-label="Restore warning" class="surface-popover flex rounded-lg p-2">
             @isset($icon)
                 <span
                     class="flex size-7 shrink-0 items-center justify-center rounded-md bg-amber-100 text-amber-700 dark:bg-warning/10 dark:text-warning">
@@ -65,12 +64,11 @@
     </template>
 
     <template x-if="!iconOnly">
-    <div class="relative flex items-start gap-2.5 rounded-lg p-3 pr-10"
+    <div class="surface-popover relative flex items-start gap-2.5 rounded-lg p-3 pr-10"
         :class="compact
             ? 'w-[calc(100vw-2rem)] max-w-sm cursor-pointer'
             : 'w-[calc(100vw-2rem)] max-w-sm'"
-        @click="restore()"
-        style="background: var(--coollabs-elevated); box-shadow: 0 0 0 1px var(--coollabs-line), var(--shadow-modal);">
+        @click="restore()">
         @isset($icon)
             <div
                 class="flex size-7 shrink-0 items-center justify-center rounded-md bg-amber-100 text-amber-700 dark:bg-warning/10 dark:text-warning">
diff --git a/resources/views/components/popup.blade.php b/resources/views/components/popup.blade.php
index abb8881509..f5f3575995 100644
--- a/resources/views/components/popup.blade.php
+++ b/resources/views/components/popup.blade.php
@@ -11,7 +11,7 @@
         {{ $customActions }}
     @else
         <div
-            class="flex lg:items-center flex-col justify-between w-full h-full max-w-4xl p-6 mx-auto bg-white border shadow-lg lg:border-t dark:border-coolgray-300 border-neutral-200 dark:bg-coolgray-100 lg:p-8 lg:flex-row sm:rounded-sm">
+            class="flex lg:items-center flex-col justify-between w-full h-full max-w-4xl p-6 mx-auto bg-white border shadow-modal lg:border-t dark:border-coolgray-300 border-neutral-200 dark:bg-coolgray-100 lg:p-8 lg:flex-row sm:rounded-sm">
             <div
                 class="flex flex-col items-start h-full pb-6 text-xs lg:items-center lg:flex-row lg:pb-0 lg:pr-6 lg:space-x-5 dark:text-neutral-300">
                 @if (isset($icon))
diff --git a/resources/views/components/proxy-configuration-warning.blade.php b/resources/views/components/proxy-configuration-warning.blade.php
index 7337779d0e..51f4282944 100644
--- a/resources/views/components/proxy-configuration-warning.blade.php
+++ b/resources/views/components/proxy-configuration-warning.blade.php
@@ -9,8 +9,7 @@
     </button>
 
     <div x-show="open" x-cloak x-transition.opacity role="dialog"
-        class="fixed top-14 left-1/2 z-[1100] w-[calc(100vw-2rem)] max-w-sm -translate-x-1/2 rounded-lg p-3 lg:absolute lg:top-full lg:right-0 lg:left-auto lg:mt-2 lg:translate-x-0"
-        style="background: var(--coollabs-elevated); box-shadow: 0 0 0 1px var(--coollabs-line), var(--shadow-modal);">
+        class="surface-popover fixed top-14 left-1/2 z-[1100] w-[calc(100vw-2rem)] max-w-sm -translate-x-1/2 rounded-lg p-3 lg:absolute lg:top-full lg:right-0 lg:left-auto lg:mt-2 lg:translate-x-0">
         <div class="flex items-start gap-2.5">
             <span
                 class="flex size-7 shrink-0 items-center justify-center rounded-md bg-amber-100 text-amber-700 dark:bg-warning/10 dark:text-warning">
diff --git a/resources/views/components/resources/breadcrumbs.blade.php b/resources/views/components/resources/breadcrumbs.blade.php
index 9ef4c1b0e8..95e9cbf538 100644
--- a/resources/views/components/resources/breadcrumbs.blade.php
+++ b/resources/views/components/resources/breadcrumbs.blade.php
@@ -91,7 +91,7 @@
                     x-transition:enter-start="opacity-0 scale-95" x-transition:enter-end="opacity-100 scale-100"
                     x-transition:leave="transition ease-in duration-75" x-transition:leave-start="opacity-100 scale-100"
                     x-transition:leave-end="opacity-0 scale-95"
-                    class="absolute z-20 top-full mt-1 w-56 -ml-2 bg-white dark:bg-coolgray-100 rounded-md shadow-lg py-1 border border-neutral-200 dark:border-coolgray-200 max-h-96 overflow-y-auto scrollbar">
+                    class="absolute z-20 top-full mt-1 w-56 -ml-2 bg-white dark:bg-coolgray-100 rounded-md shadow-[var(--shadow-dropdown)] py-1 border border-neutral-200 dark:border-coolgray-200 max-h-96 overflow-y-auto scrollbar">
                     @foreach ($projects as $project)
                         <a href="{{ route('project.show', ['project_uuid' => $project->uuid]) }}" {{ wireNavigate() }}
                             class="block px-4 py-2 text-sm truncate hover:bg-neutral-100 dark:hover:bg-coolgray-200 {{ $project->uuid === $currentProjectUuid ? 'dark:text-warning font-semibold' : '' }}"
@@ -130,7 +130,7 @@
                     x-init="$nextTick(() => { const rect = $el.getBoundingClientRect(); if (rect.right > window.innerWidth) { $el.style.left = 'auto'; $el.style.right = '0'; } })">
                     <!-- Environment List -->
                     <div
-                        class="relative w-48 bg-white dark:bg-coolgray-100 rounded-md shadow-lg py-1 border border-neutral-200 dark:border-coolgray-200 max-h-96 overflow-y-auto scrollbar">
+                        class="relative w-48 bg-white dark:bg-coolgray-100 rounded-md shadow-[var(--shadow-dropdown)] py-1 border border-neutral-200 dark:border-coolgray-200 max-h-96 overflow-y-auto scrollbar">
                         @foreach ($environments as $environment)
                             @php
                                 $envDatabases = collect()
@@ -205,7 +205,7 @@
                                 :style="'position: absolute; left: 100%; top: ' + (envPositions['{{ $environment->uuid }}'] || 0) + 'px; z-index: 30;'"
                                 class="flex flex-col sm:flex-row items-start pl-1">
                                 <div
-                                    class="relative w-56 bg-white dark:bg-coolgray-100 rounded-md shadow-lg py-1 border border-neutral-200 dark:border-coolgray-200 max-h-96 overflow-y-auto scrollbar">
+                                    class="relative w-56 bg-white dark:bg-coolgray-100 rounded-md shadow-[var(--shadow-dropdown)] py-1 border border-neutral-200 dark:border-coolgray-200 max-h-96 overflow-y-auto scrollbar">
                                     @foreach ($envResources as $envResource)
                                         @php
                                             $resType = $envResource['type'];
diff --git a/resources/views/components/section-heading.blade.php b/resources/views/components/section-heading.blade.php
new file mode 100644
index 0000000000..523808102f
--- /dev/null
+++ b/resources/views/components/section-heading.blade.php
@@ -0,0 +1,34 @@
+@props([
+    'title',
+    'subtitle' => null,
+    'href' => null,
+    'actionLabel' => 'View all',
+    'icon' => 'arrow-right',
+])
+
+{{--
+    Shared section heading: a 14px title, an optional 11px muted subtitle, and an
+    optional right-aligned action. Pass `href` for the default ghost "View all"
+    button, or an `<x-slot:actions>` for a custom control.
+--}}
+<div {{ $attributes->merge(['class' => 'mb-3 min-w-0']) }}>
+    <div class="flex items-center justify-between gap-4">
+        <h2 class="min-w-0 truncate text-[14px]! leading-5! font-semibold! text-black dark:text-fg">
+            {{ $title }}
+        </h2>
+        @isset($actions)
+            <div class="shrink-0">{{ $actions }}</div>
+        @elseif (filled($href))
+            <a href="{{ $href }}" {{ wireNavigate() }}
+                class="group inline-flex h-7 shrink-0 items-center gap-1.5 rounded-md border border-neutral-200 bg-white px-2.5 text-[12px] font-medium text-neutral-600 transition-[color,background-color,transform] duration-100 ease-out hover:bg-neutral-100 hover:text-black active:scale-[0.97] dark:border-white/[0.08] dark:bg-white/[0.06] dark:text-fg-dim dark:hover:bg-white/[0.1] dark:hover:text-fg">
+                {{ $actionLabel }}
+                @if ($icon)
+                    <x-reicon :name="$icon" class="size-3 opacity-70 transition-transform duration-150 ease-out group-hover:translate-x-0.5" />
+                @endif
+            </a>
+        @endisset
+    </div>
+    @if (filled($subtitle))
+        <p class="mt-0.5 text-[11px] text-neutral-500 dark:text-fg-faint">{{ $subtitle }}</p>
+    @endif
+</div>
diff --git a/resources/views/components/server/provider-token-picker.blade.php b/resources/views/components/server/provider-token-picker.blade.php
index aa05a4e7ef..04029216aa 100644
--- a/resources/views/components/server/provider-token-picker.blade.php
+++ b/resources/views/components/server/provider-token-picker.blade.php
@@ -28,7 +28,7 @@
         <div class="grid grid-cols-1 gap-3 p-3 sm:grid-cols-2 lg:grid-cols-4">
             @foreach ($tokens as $token)
                 <a wire:key="{{ $provider }}-token-{{ $token->id }}"
-                    class="group flex min-h-28 min-w-0 flex-col rounded-xl border border-neutral-200 bg-white p-3 shadow-sm transition-all hover:-translate-y-px hover:border-neutral-300 hover:no-underline hover:shadow-md dark:border-white/[0.08] dark:bg-white/[0.025] dark:hover:border-white/[0.14]"
+                    class="group flex min-h-28 min-w-0 flex-col rounded-xl border border-neutral-200 bg-white p-3 shadow-sm transition-all hover:-translate-y-px hover:border-neutral-300 hover:no-underline hover:shadow-md dark:border-white/[0.08] dark:bg-white/[0.05] dark:hover:border-white/[0.14]"
                     href="{{ route('server.create.token', ['type' => $routeType ?: $provider, 'token_uuid' => $token->uuid]) }}"
                     {{ wireNavigate() }}>
                     <div class="flex items-start gap-3">
diff --git a/resources/views/components/shared-variables/editor.blade.php b/resources/views/components/shared-variables/editor.blade.php
index 810b7f69cf..c2c85a3e4e 100644
--- a/resources/views/components/shared-variables/editor.blade.php
+++ b/resources/views/components/shared-variables/editor.blade.php
@@ -5,6 +5,7 @@
     'title',
     'view',
     'variablesLabel',
+    'readOnlyKeys' => [],
 ])
 
 @php
@@ -105,15 +106,32 @@
                     <div class="data-table-header env-table-grid-shared order-[-1]">
                         <span>Name</span>
                         <span>Scope</span>
-                        <span>Comment</span>
+                        <span>{{ count($readOnlyKeys) ? 'Value / comment' : 'Comment' }}</span>
                         <span class="text-center">Multiline</span>
                         <span></span>
                     </div>
                     @foreach ($variables as $env)
-                        <livewire:project.shared.environment-variable.show
-                            wire:key="shared-variable-{{ $type }}-{{ $env->id }}" :env="$env"
-                            :type="$type" :tableAlphabeticalOrder="$alphabeticalPositions[$env->id]"
-                            :tableCreationOrder="$loop->index" />
+                        @if (in_array($env->key, $readOnlyKeys))
+                            <div wire:key="shared-variable-{{ $type }}-{{ $env->id }}" class="env-table-item"
+                                :style="`order: ${sharedSort === 'alphabetical' ? {{ $alphabeticalPositions[$env->id] }} : {{ $loop->index }}}`"
+                                x-show="@js(mb_strtolower($env->key . ' ' . ($env->comment ?? '') . ' ' . $type)).includes(sharedSearch.trim().toLowerCase())">
+                                <div class="data-table-row env-table-grid-shared">
+                                    <div class="min-w-0">
+                                        <div class="env-key-label truncate font-mono text-[13px]" title="{{ $env->key }}">{{ $env->key }}</div>
+                                        <div class="text-[11px] text-neutral-500 dark:text-fg-dim">Built-in · Read-only</div>
+                                    </div>
+                                    <span class="env-type-desktop text-[13px] text-neutral-500 dark:text-fg-dim">{{ str($type)->headline() }}</span>
+                                    <span class="min-w-0 truncate font-mono text-[13px]" title="{{ $env->value }}">{{ $env->value }}</span>
+                                    <span class="data-table-cell-dash">-</span>
+                                    <span class="justify-self-end text-neutral-400 dark:text-fg-faint" title="Built-in variable, managed by Coolify"><x-reicon name="lock" class="size-3.5" /></span>
+                                </div>
+                            </div>
+                        @else
+                            <livewire:project.shared.environment-variable.show
+                                wire:key="shared-variable-{{ $type }}-{{ $env->id }}" :env="$env"
+                                :type="$type" :tableAlphabeticalOrder="$alphabeticalPositions[$env->id]"
+                                :tableCreationOrder="$loop->index" />
+                        @endif
                     @endforeach
                     <div
                         class="order-[9999] flex min-h-11 items-center border-t border-neutral-200 px-4 text-[11px] text-neutral-500 dark:border-white/[0.08] dark:text-fg-faint">
@@ -122,6 +140,14 @@
                 </div>
             @endif
         @else
+            @if ($variables->whereIn('key', $readOnlyKeys)->isNotEmpty())
+                <div class="border-b border-neutral-200 p-4 dark:border-white/[0.08]">
+                    <div class="mb-2 text-[12px] text-neutral-500 dark:text-fg-dim">Built-in · Read-only</div>
+                    @foreach ($variables->whereIn('key', $readOnlyKeys)->sortBy('key') as $env)
+                        <div class="break-all font-mono text-[13px]">{{ $env->key }}={{ $env->value }}</div>
+                    @endforeach
+                </div>
+            @endif
             <form wire:submit="submit" class="p-4">
                 <x-unsaved-bar action="submit" />
                 <x-forms.textarea canGate="update" :canResource="$resource" rows="20"
diff --git a/resources/views/components/slide-over.blade.php b/resources/views/components/slide-over.blade.php
index 90e568ae13..a8a9b96653 100644
--- a/resources/views/components/slide-over.blade.php
+++ b/resources/views/components/slide-over.blade.php
@@ -16,22 +16,26 @@ x-init="$watch('slideOverOpen', value => {
         <div x-show="slideOverOpen" @if (!$closeWithX) @keydown.window.escape="slideOverOpen=false" @endif
             class="relative z-99 ">
             <div x-show="slideOverOpen" @if (!$closeWithX) @click="slideOverOpen = false" @endif
+                x-transition:enter="transition-opacity ease-out duration-300"
+                x-transition:enter-start="opacity-0" x-transition:enter-end="opacity-100"
+                x-transition:leave="transition-opacity ease-in duration-200"
+                x-transition:leave-start="opacity-100" x-transition:leave-end="opacity-0"
                 class="fixed inset-0 dark:bg-black/60 backdrop-blur-xs"></div>
             <div class="fixed inset-0 overflow-hidden">
                 <div class="absolute inset-0 overflow-hidden ">
                     <div class="fixed inset-y-0 right-0 flex max-w-full pl-10">
                         <div x-show="slideOverOpen"
                             @if (!$closeWithX) @click.away="slideOverOpen = false" @endif
-                            x-transition:enter="transform transition ease-in-out duration-100 sm:duration-300"
+                            x-transition:enter="transform transition ease-[cubic-bezier(0.32,0.72,0,1)] duration-200 sm:duration-300"
                             x-transition:enter-start="translate-x-full" x-transition:enter-end="translate-x-0"
-                            x-transition:leave="transform transition ease-in-out duration-100 sm:duration-300"
+                            x-transition:leave="transform transition ease-in duration-200"
                             x-transition:leave-start="translate-x-0" x-transition:leave-end="translate-x-full"
                             @class([
                                 'max-w-xl w-screen' => !$fullScreen,
                                 'max-w-4xl w-screen' => $fullScreen,
                             ])>
                             <div
-                                class="flex flex-col h-full py-6 overflow-hidden border-l shadow-lg bg-neutral-50 dark:bg-base dark:border-neutral-800 border-neutral-200">
+                                class="flex flex-col h-full py-6 overflow-hidden border-l shadow-modal bg-neutral-50 dark:bg-base dark:border-neutral-800 border-neutral-200">
                                 <div class="px-4 pb-4 sm:px-5">
                                     <div class="flex items-start justify-between pb-1">
                                         <h2 class="text-2xl leading-6" id="slide-over-title">
diff --git a/resources/views/components/status-summary.blade.php b/resources/views/components/status-summary.blade.php
index 88102f57ef..27010cda9f 100644
--- a/resources/views/components/status-summary.blade.php
+++ b/resources/views/components/status-summary.blade.php
@@ -1,4 +1,4 @@
-@props(['status', 'title' => 'Application status', 'containerName' => 'Container'])
+@props(['status', 'title' => 'Application status', 'containerName' => 'Container', 'align' => 'left'])
 
 @php
     $rawStatus = str((string) $status)->lower()->trim()->value();
@@ -62,8 +62,12 @@
         </span>
     </x-status-badge>
 
-    <div x-cloak x-show="open" x-transition.origin.top.left
-        class="listbox-panel top-8! right-auto! left-0! z-[90]! w-[min(16rem,calc(100vw-1.5rem))]! min-w-0! sm:w-64! sm:min-w-64!" role="menu">
+    <div x-cloak x-show="open" x-transition.origin.top.{{ $align === 'right' ? 'right' : 'left' }}
+        @class([
+            'listbox-panel top-8! z-[90]! w-[min(16rem,calc(100vw-1.5rem))]! min-w-0! sm:w-64! sm:min-w-64!',
+            'right-auto! left-0!' => $align !== 'right',
+            'left-auto! right-0!' => $align === 'right',
+        ]) role="menu">
         <div class="px-3 py-2 text-[11px] font-medium text-neutral-400 dark:text-fg-faint">{{ $title }}</div>
         <div class="listbox-option cursor-default! gap-2.5!">
             <span @class([
diff --git a/resources/views/components/table/dropdown.blade.php b/resources/views/components/table/dropdown.blade.php
index c3ff1a2e5b..e6bc1518f5 100644
--- a/resources/views/components/table/dropdown.blade.php
+++ b/resources/views/components/table/dropdown.blade.php
@@ -36,7 +36,13 @@
     </div>
 
     <div x-ref="panel" x-show="open" x-cloak :style="panelStyle"
-        class="listbox-panel fixed! right-auto! bottom-auto! z-[90]! mt-0! {{ $panelClass }}" role="{{ $role }}"
+        x-transition:enter="transition ease-out duration-150"
+        x-transition:enter-start="opacity-0 -translate-y-1 scale-[0.98]"
+        x-transition:enter-end="opacity-100 translate-y-0 scale-100"
+        x-transition:leave="transition ease-in duration-100"
+        x-transition:leave-start="opacity-100 translate-y-0 scale-100"
+        x-transition:leave-end="opacity-0 -translate-y-1 scale-[0.98]"
+        class="listbox-panel origin-top fixed! right-auto! bottom-auto! z-[90]! mt-0! {{ $panelClass }}" role="{{ $role }}"
         @if ($multiselectable) aria-multiselectable="true" @endif>
         {{ $slot }}
     </div>
diff --git a/resources/views/components/terminal/theme-selector.blade.php b/resources/views/components/terminal/theme-selector.blade.php
index 18f0585fd2..8273632bf8 100644
--- a/resources/views/components/terminal/theme-selector.blade.php
+++ b/resources/views/components/terminal/theme-selector.blade.php
@@ -14,7 +14,7 @@
     </button>
 
     <div x-cloak x-show="themeOpen" x-transition.origin.top.right
-        class="console-theme-selector absolute top-11 right-0 z-50 max-h-80 w-56 overflow-y-auto rounded-lg border border-neutral-200 bg-white p-1 shadow-[0_18px_50px_rgba(0,0,0,0.18)] dark:border-white/[0.1] dark:bg-[#111113] dark:shadow-[0_18px_50px_rgba(0,0,0,0.55)]">
+        class="console-theme-selector absolute top-11 right-0 z-50 max-h-80 w-56 overflow-y-auto rounded-lg border border-neutral-200 bg-white p-1 shadow-[var(--shadow-dropdown)] dark:border-white/[0.1] dark:bg-[#111113]">
         @foreach ($themes as $theme)
             <button type="button"
                 class="flex h-8 w-full items-center gap-2 rounded-md px-2 text-left text-[11px] text-neutral-600 transition-colors hover:bg-neutral-100 hover:text-neutral-950 dark:text-white/65 dark:hover:bg-white/[0.07] dark:hover:text-white"
diff --git a/resources/views/components/theme-controls.blade.php b/resources/views/components/theme-controls.blade.php
new file mode 100644
index 0000000000..795aefaa2e
--- /dev/null
+++ b/resources/views/components/theme-controls.blade.php
@@ -0,0 +1,185 @@
+@props(['variant' => 'full'])
+
+@php($checkPath = 'm2.5 6.25 2.1 2.1 4.9-5')
+
+@if ($variant === 'menu')
+    {{-- Compact list for the profile dropdown. The parent controls visibility;
+         all theme state/logic comes from the shared window.themeControls(). --}}
+    <div x-data="themeControls()" class="grid gap-0.5">
+        @foreach ([
+            ['value' => 'light', 'label' => 'Light'],
+            ['value' => 'system', 'label' => 'System'],
+            ['value' => 'dark', 'label' => 'Dark'],
+            ['value' => 'custom', 'label' => 'Custom'],
+        ] as $option)
+            @if ($option['value'] === 'custom')
+                <div class="relative" @click.outside="pickerOpen = false">
+                    <button type="button" @click="chooseCustom()" aria-haspopup="dialog" :aria-expanded="pickerOpen"
+                        class="flex h-8 w-full items-center justify-between rounded-md px-2 text-left text-xs text-neutral-600 transition-colors hover:bg-neutral-200 hover:text-neutral-950 dark:text-fg-dim dark:hover:bg-white/[0.06] dark:hover:text-fg">
+                        <span class="flex items-center gap-2">
+                            <span class="size-3.5 rounded-full border border-white/20"
+                                :style="`background: ${themeColor}`"></span>
+                            Custom
+                        </span>
+                        <svg x-show="theme === 'custom'" class="size-3.5 text-coollabs dark:text-warning"
+                            viewBox="0 0 12 12" fill="none" aria-hidden="true">
+                            <path d="{{ $checkPath }}" stroke="currentColor" stroke-width="1.4"
+                                stroke-linecap="round" stroke-linejoin="round" />
+                        </svg>
+                    </button>
+                    <x-theme-controls.picker position="left-full top-0 ml-2" />
+                </div>
+            @else
+                <button type="button" @click="setTheme('{{ $option['value'] }}')"
+                    class="flex h-8 w-full items-center justify-between rounded-md px-2 text-left text-xs text-neutral-600 transition-colors hover:bg-neutral-200 hover:text-neutral-950 dark:text-fg-dim dark:hover:bg-white/[0.06] dark:hover:text-fg">
+                    <span>{{ $option['label'] }}</span>
+                    <svg x-show="theme === '{{ $option['value'] }}'"
+                        class="size-3.5 text-coollabs dark:text-warning" viewBox="0 0 12 12" fill="none"
+                        aria-hidden="true">
+                        <path d="{{ $checkPath }}" stroke="currentColor" stroke-width="1.4"
+                            stroke-linecap="round" stroke-linejoin="round" />
+                    </svg>
+                </button>
+            @endif
+        @endforeach
+        <div class="my-1 h-px bg-neutral-200 dark:bg-white/[0.07]"></div>
+        <div class="px-2 pt-1 pb-0.5 text-[10px] font-medium tracking-wide text-neutral-400 uppercase dark:text-fg-faint">
+            Page width
+        </div>
+        @foreach ([
+            ['value' => 'full', 'label' => 'Full width'],
+            ['value' => 'centered', 'label' => 'Centered'],
+        ] as $option)
+            <button type="button" @click="setWidth('{{ $option['value'] }}')"
+                class="flex h-8 w-full items-center justify-between rounded-md px-2 text-left text-xs text-neutral-600 transition-colors hover:bg-neutral-200 hover:text-neutral-950 dark:text-fg-dim dark:hover:bg-white/[0.06] dark:hover:text-fg">
+                <span>{{ $option['label'] }}</span>
+                <svg x-show="pageWidth === '{{ $option['value'] }}'"
+                    class="size-3.5 text-coollabs dark:text-warning" viewBox="0 0 12 12" fill="none"
+                    aria-hidden="true">
+                    <path d="{{ $checkPath }}" stroke="currentColor" stroke-width="1.4"
+                        stroke-linecap="round" stroke-linejoin="round" />
+                </svg>
+            </button>
+        @endforeach
+    </div>
+@else
+    {{-- Full card grid for the Appearance settings page. --}}
+    <div x-data="themeControls()" class="mt-8 flex w-full max-w-none flex-col gap-6 lg:mt-3">
+        <section class="application-settings-section">
+            <div class="application-settings-section-header">
+                <div>
+                    <h2>Color theme</h2>
+                    <p>Choose the color scheme used in this browser.</p>
+                </div>
+            </div>
+            <div class="application-settings-section-body grid gap-3 sm:grid-cols-2 lg:grid-cols-4">
+                @foreach ([
+                    ['value' => 'light', 'label' => 'Light', 'description' => 'Bright surfaces and dark text.', 'preview' => 'bg-white'],
+                    ['value' => 'system', 'label' => 'System', 'description' => 'Follow your operating system.', 'preview' => 'bg-gradient-to-r from-white via-neutral-400 to-[#050505]'],
+                    ['value' => 'dark', 'label' => 'Dark', 'description' => 'Dark surfaces and soft contrast.', 'preview' => 'bg-[#181818]'],
+                    ['value' => 'custom', 'label' => 'Custom', 'description' => 'Tint light or dark surfaces with any color.', 'preview' => ''],
+                ] as $option)
+                    @if ($option['value'] === 'custom')
+                        {{-- Clicking the card opens the custom color picker popover (color + light/dark). --}}
+                        <div class="relative" @click.outside="pickerOpen = false">
+                            <div role="button" tabindex="0" @click="chooseCustom()" @keydown.enter.prevent="chooseCustom()"
+                                aria-haspopup="dialog" :aria-expanded="pickerOpen"
+                                class="group block w-full overflow-hidden rounded-[10px] border border-neutral-200 bg-white text-left transition-[border-color,box-shadow] hover:border-neutral-300 hover:shadow-sm dark:border-white/[0.07] dark:bg-white/[0.05] dark:hover:border-white/[0.12]"
+                                :class="theme === 'custom'
+                                    ? 'ring-1 ring-coollabs/30 border-coollabs/40 dark:ring-warning/30 dark:border-warning/40'
+                                    : ''">
+                                <div class="h-20 border-b border-neutral-200 dark:border-white/[0.07]"
+                                    :style="`background: color-mix(in oklab, ${themeColor} 28%, ${customMode === 'light' ? 'oklch(97% 0 0)' : 'oklch(17.35% 0.0020 286.18)'})`">
+                                    <div class="flex h-full items-center justify-center">
+                                        <div class="h-10 w-20 rounded-md border border-white/15 p-1 shadow-sm">
+                                            <div class="h-full w-full rounded-sm" :style="`background: ${themeColor}`"></div>
+                                        </div>
+                                    </div>
+                                </div>
+                                <div class="p-3">
+                                    <div class="flex items-center justify-between gap-2">
+                                        <span class="text-sm font-semibold text-black dark:text-fg">{{ $option['label'] }}</span>
+                                        <x-reicon name="check-circle" class="size-4 text-coollabs dark:text-warning"
+                                            x-show="theme === 'custom'" x-cloak />
+                                    </div>
+                                    <p class="mt-1 text-xs leading-5 text-neutral-500 dark:text-fg-dim">
+                                        {{ $option['description'] }}
+                                    </p>
+                                </div>
+                            </div>
+                            <x-theme-controls.picker position="left-0 top-full mt-2" />
+                        </div>
+                    @else
+                        <div role="button" tabindex="0"
+                            @click="setTheme('{{ $option['value'] }}')"
+                            @keydown.enter.prevent="setTheme('{{ $option['value'] }}')"
+                            class="group relative overflow-hidden rounded-[10px] border border-neutral-200 bg-white text-left transition-[border-color,box-shadow] hover:border-neutral-300 hover:shadow-sm dark:border-white/[0.07] dark:bg-white/[0.05] dark:hover:border-white/[0.12]"
+                            :class="theme === '{{ $option['value'] }}'
+                                ? 'ring-1 ring-coollabs/30 border-coollabs/40 dark:ring-warning/30 dark:border-warning/40'
+                                : ''">
+                            <div class="h-20 {{ $option['preview'] }} border-b border-neutral-200 dark:border-white/[0.07]">
+                                <div class="flex h-full items-center justify-center">
+                                    <div
+                                        class="h-8 w-20 rounded-md border border-black/10 bg-neutral-100/80 shadow-sm dark:border-white/10 dark:bg-black/20">
+                                    </div>
+                                </div>
+                            </div>
+                            <div class="p-3">
+                                <div class="flex items-center justify-between gap-2">
+                                    <span class="text-sm font-semibold text-black dark:text-fg">
+                                        {{ $option['label'] }}
+                                    </span>
+                                    <x-reicon name="check-circle" class="size-4 text-coollabs dark:text-warning"
+                                        x-show="theme === '{{ $option['value'] }}'" x-cloak />
+                                </div>
+                                <p class="mt-1 text-xs leading-5 text-neutral-500 dark:text-fg-dim">
+                                    {{ $option['description'] }}
+                                </p>
+                            </div>
+                        </div>
+                    @endif
+                @endforeach
+            </div>
+        </section>
+
+        <section class="application-settings-section">
+            <div class="application-settings-section-header">
+                <div>
+                    <h2>Page width</h2>
+                    <p>Choose how content uses the available browser width.</p>
+                </div>
+            </div>
+            <div class="application-settings-section-body grid gap-3 sm:grid-cols-2">
+                @foreach ([
+                    ['value' => 'full', 'label' => 'Full width', 'description' => 'Use all available space for page content.'],
+                    ['value' => 'centered', 'label' => 'Centered', 'description' => 'Keep content centered at a comfortable maximum width.'],
+                ] as $option)
+                    <button type="button" @click="setWidth('{{ $option['value'] }}')"
+                        class="group overflow-hidden rounded-[10px] border border-neutral-200 bg-white text-left transition-[border-color,box-shadow] hover:border-neutral-300 hover:shadow-sm dark:border-white/[0.07] dark:bg-white/[0.05] dark:hover:border-white/[0.12]"
+                        :class="pageWidth === '{{ $option['value'] }}'
+                            ? 'ring-1 ring-coollabs/30 border-coollabs/40 dark:ring-warning/30 dark:border-warning/40'
+                            : ''">
+                        <div class="flex h-20 items-center border-b border-neutral-200 bg-neutral-50 px-4 dark:border-white/[0.07] dark:bg-black/15">
+                            <div class="flex h-11 w-full gap-1.5 rounded-md border border-neutral-300 bg-white p-1.5 dark:border-white/15 dark:bg-[#181818]">
+                                <div class="w-3 shrink-0 rounded-sm bg-neutral-200 dark:bg-white/10"></div>
+                                <div @class([
+                                    'h-full rounded-sm bg-neutral-200 dark:bg-white/10',
+                                    'w-full' => $option['value'] === 'full',
+                                    'mx-auto w-2/3' => $option['value'] === 'centered',
+                                ])></div>
+                            </div>
+                        </div>
+                        <div class="p-3">
+                            <div class="flex items-center justify-between gap-2">
+                                <span class="text-sm font-semibold text-black dark:text-fg">{{ $option['label'] }}</span>
+                                <x-reicon name="check-circle" class="size-4 text-coollabs dark:text-warning"
+                                    x-show="pageWidth === '{{ $option['value'] }}'" x-cloak />
+                            </div>
+                            <p class="mt-1 text-xs leading-5 text-neutral-500 dark:text-fg-dim">{{ $option['description'] }}</p>
+                        </div>
+                    </button>
+                @endforeach
+            </div>
+        </section>
+    </div>
+@endif
diff --git a/resources/views/components/theme-controls/picker.blade.php b/resources/views/components/theme-controls/picker.blade.php
new file mode 100644
index 0000000000..f4b1ede294
--- /dev/null
+++ b/resources/views/components/theme-controls/picker.blade.php
@@ -0,0 +1,48 @@
+@props(['position' => 'left-0 top-full mt-2'])
+
+{{-- Custom color picker popover: color field + light/dark mode in one panel.
+     Renders inline (no own Alpine scope) so it uses the parent themeControls()
+     state: pickerOpen, themeColor, customMode, previewThemeColor, saveThemeColor,
+     setCustomMode. --}}
+<div x-show="pickerOpen" x-cloak
+    x-transition:enter="transition ease-out duration-150"
+    x-transition:enter-start="opacity-0 -translate-y-1 scale-[0.98]"
+    x-transition:enter-end="opacity-100 translate-y-0 scale-100"
+    x-transition:leave="transition ease-in duration-100"
+    x-transition:leave-start="opacity-100 translate-y-0 scale-100"
+    x-transition:leave-end="opacity-0 -translate-y-1 scale-[0.98]"
+    role="dialog" aria-label="Custom color"
+    class="absolute z-[60] w-60 origin-top {{ $position }} rounded-xl border border-neutral-200 bg-white p-3 text-left shadow-dropdown dark:border-white/[0.1] dark:bg-panel">
+    <div class="mb-2 text-[11px] font-semibold tracking-wide text-neutral-400 uppercase dark:text-fg-faint">
+        Custom color
+    </div>
+    <label class="flex cursor-pointer items-center gap-2.5 rounded-lg border border-neutral-200 p-2 transition-colors hover:border-neutral-300 dark:border-white/[0.08] dark:hover:border-white/[0.14]">
+        <span class="relative size-8 shrink-0 overflow-hidden rounded-md border border-black/10 shadow-sm dark:border-white/15">
+            <span class="absolute inset-0" :style="`background: ${themeColor}`"></span>
+            <input type="color" :value="themeColor" @input="previewThemeColor($event.target.value)"
+                @change="saveThemeColor($event.target.value)" aria-label="Custom theme color"
+                class="absolute inset-0 h-full w-full cursor-pointer opacity-0" />
+        </span>
+        <span class="flex min-w-0 flex-col">
+            <span class="text-xs font-medium text-black dark:text-fg">Pick a color</span>
+            <span class="text-[11px] tracking-wide text-neutral-500 uppercase dark:text-fg-dim" x-text="themeColor"></span>
+        </span>
+    </label>
+    <div class="mt-2 grid grid-cols-2 gap-1 rounded-lg border border-neutral-200 p-0.5 dark:border-white/[0.08]"
+        role="group" aria-label="Custom theme mode">
+        <button type="button" @click="setCustomMode('light')" :aria-pressed="customMode === 'light'"
+            class="rounded-md py-1.5 text-xs font-medium transition-colors"
+            :class="customMode === 'light'
+                ? 'bg-neutral-100 text-black shadow-sm dark:bg-white/[0.14] dark:text-fg'
+                : 'text-neutral-500 hover:text-black dark:text-fg-dim dark:hover:text-fg'">
+            Light
+        </button>
+        <button type="button" @click="setCustomMode('dark')" :aria-pressed="customMode === 'dark'"
+            class="rounded-md py-1.5 text-xs font-medium transition-colors"
+            :class="customMode === 'dark'
+                ? 'bg-neutral-100 text-black shadow-sm dark:bg-white/[0.14] dark:text-fg'
+                : 'text-neutral-500 hover:text-black dark:text-fg-dim dark:hover:text-fg'">
+            Dark
+        </button>
+    </div>
+</div>
diff --git a/resources/views/components/toast.blade.php b/resources/views/components/toast.blade.php
index 8c3eef13ef..1800372504 100644
--- a/resources/views/components/toast.blade.php
+++ b/resources/views/components/toast.blade.php
@@ -8,6 +8,7 @@
                     description: options.description ?? '',
                     position: options.position ?? 'bottom-right',
                     html: options.html ?? '',
+                    persistent: options.persistent ?? false,
                 },
             }));
         } catch (error) {
@@ -29,14 +30,19 @@
                     type: event.detail.type,
                     html: event.detail.html ? window.sanitizeHTML(event.detail.html) : '',
                     timeout: null,
+                    persistent: event.detail.persistent === true,
                     copied: false,
                     copiedTimeout: null,
                 };
 
                 this.toasts.unshift(toast);
                 if (this.toasts.length > 4) {
-                    const removed = this.toasts.pop();
-                    clearTimeout(removed?.timeout);
+                    const index = this.toasts.findLastIndex(item => !item.persistent);
+                    if (index !== -1) {
+                        const [removed] = this.toasts.splice(index, 1);
+                        clearTimeout(removed.timeout);
+                        clearTimeout(removed.copiedTimeout);
+                    }
                 }
 
                 this.$nextTick(() => {
@@ -49,6 +55,7 @@
             },
             scheduleToast(toast, delay = 2000) {
                 clearTimeout(toast.timeout);
+                if (toast.persistent) return;
                 toast.timeout = setTimeout(() => this.removeToast(toast.id), delay);
             },
             pauseToast(toast) {
@@ -94,10 +101,9 @@
                     x-transition:enter-end="translate-y-0 opacity-100"
                     x-transition:leave="transition ease-in duration-150"
                     x-transition:leave-start="translate-y-0 opacity-100"
-                    x-transition:leave-end="-translate-y-1 opacity-0"
+                    x-transition:leave-end="translate-y-1 opacity-0"
                     @mouseenter="pauseToast(toast)" @mouseleave="resumeToast(toast)"
-                    class="relative flex w-full items-start rounded-lg group"
-                    style="background: var(--coollabs-elevated); box-shadow: 0 0 0 1px var(--coollabs-line), var(--shadow-modal);"
+                    class="surface-popover relative flex w-full items-start rounded-lg group"
                     :class="{ 'p-3.5 pr-20': !toast.html, 'p-0': toast.html }">
                     <template x-if="!toast.html">
                         <div class="flex min-w-0 items-start gap-3">
diff --git a/resources/views/components/top-user-menu.blade.php b/resources/views/components/top-user-menu.blade.php
index 7fdc312cbc..b3559970bb 100644
--- a/resources/views/components/top-user-menu.blade.php
+++ b/resources/views/components/top-user-menu.blade.php
@@ -11,10 +11,6 @@
 <div @class(['relative', 'min-w-0' => $sidebar]) x-data="{
     open: false,
     appearanceOpen: false,
-    theme: localStorage.getItem('theme') === 'purple' ? 'custom' : (localStorage.getItem('theme') || 'dark'),
-    pageWidth: localStorage.getItem('pageWidth') || 'full',
-    themeColor: localStorage.getItem('themeColor') || '#6b16ed',
-    themeColorFrame: null,
     avatarUrl: @js($user?->avatar_path ? profile_avatar_url($user) : null),
     openPanel() {
         this.appearanceOpen = false;
@@ -23,51 +19,6 @@
     closePanel() {
         this.open = false;
     },
-    setTheme(type, closeMenu = true) {
-        this.theme = type;
-        localStorage.setItem('theme', type);
-
-        if (closeMenu) {
-            this.closePanel();
-        }
-
-        const prefersDark = window.matchMedia('(prefers-color-scheme: dark)').matches;
-        const isDark = type === 'dark' || type === 'custom' || (type === 'system' && prefersDark);
-        document.documentElement.classList.toggle('dark', isDark);
-        document.documentElement.dataset.theme = type === 'custom' ? 'custom' : (isDark ? 'dark' : 'light');
-        document.documentElement.style.setProperty('--theme-base-color', localStorage.themeColor || '#6b16ed');
-        document.documentElement.style.setProperty('--theme-accent-foreground', window.themeAccentForeground(this.themeColor));
-        document.querySelector('meta[name=theme-color]')?.setAttribute('content', isDark ? '#101010' : '#ffffff');
-    },
-    setWidth(width) {
-        this.pageWidth = width;
-        localStorage.setItem('pageWidth', width);
-        window.dispatchEvent(new CustomEvent('page-width-changed', { detail: width }));
-    },
-    previewThemeColor(color) {
-        this.themeColor = color;
-
-        if (this.theme !== 'custom') {
-            this.theme = 'custom';
-            document.documentElement.classList.add('dark');
-            document.documentElement.dataset.theme = 'custom';
-        }
-
-        if (this.themeColorFrame) {
-            return;
-        }
-
-        this.themeColorFrame = requestAnimationFrame(() => {
-            document.documentElement.style.setProperty('--theme-base-color', this.themeColor);
-            document.documentElement.style.setProperty('--theme-accent-foreground', window.themeAccentForeground(this.themeColor));
-            this.themeColorFrame = null;
-        });
-    },
-    saveThemeColor(color) {
-        this.previewThemeColor(color);
-        localStorage.setItem('themeColor', color);
-        localStorage.setItem('theme', 'custom');
-    },
 }" @avatar-updated.window="avatarUrl = $event.detail.url" @keydown.escape.window="closePanel()"
     @click.outside="closePanel()">
     <button type="button" @click="open ? closePanel() : openPanel()"
@@ -93,8 +44,13 @@
         </svg>
     </button>
 
-    <div x-show="open" x-cloak @class([
-            'top-user-menu-panel listbox-panel z-[90]! max-h-none! w-52! min-w-0! overflow-visible! animate-in fade-in zoom-in-95 duration-150',
+    <div x-show="open" x-cloak
+        x-transition:enter="transition ease-out duration-150"
+        x-transition:enter-start="opacity-0 scale-95" x-transition:enter-end="opacity-100 scale-100"
+        x-transition:leave="transition ease-in duration-100"
+        x-transition:leave-start="opacity-100 scale-100" x-transition:leave-end="opacity-0 scale-95"
+        @class([
+            'top-user-menu-panel listbox-panel z-[90]! max-h-none! w-52! min-w-0! overflow-visible!',
             'right-0! left-auto!' => ! $sidebar,
             'bottom-full! left-0! right-auto! top-auto! mb-1!' => $sidebar,
             'origin-bottom-left' => $sidebar,
@@ -124,65 +80,26 @@
                     stroke-linejoin="round" />
             </svg>
         </button>
-        <div x-show="appearanceOpen" x-collapse class="mx-1 grid gap-0.5 pb-1 pl-6">
-            @foreach ([
-                ['value' => 'light', 'label' => 'Light'],
-                ['value' => 'system', 'label' => 'System'],
-                ['value' => 'dark', 'label' => 'Dark'],
-                ['value' => 'custom', 'label' => 'Custom'],
-            ] as $option)
-                @if ($option['value'] === 'custom')
-                    <div
-                        class="relative flex h-8 w-full items-center justify-between rounded-md px-2 text-left text-xs text-neutral-600 transition-colors hover:bg-neutral-200 hover:text-neutral-950 dark:text-fg-dim dark:hover:bg-white/[0.06] dark:hover:text-fg">
-                        <span class="flex items-center gap-2">
-                            <span class="size-3.5 rounded-full border border-white/20"
-                                :style="`background: ${themeColor}`"></span>
-                            Custom
-                        </span>
-                        <svg x-show="theme === 'custom'" class="size-3.5 text-coollabs dark:text-warning"
-                            viewBox="0 0 12 12" fill="none" aria-hidden="true">
-                            <path d="m2.5 6.25 2.1 2.1 4.9-5" stroke="currentColor" stroke-width="1.4"
-                                stroke-linecap="round" stroke-linejoin="round" />
-                        </svg>
-                        <input type="color" :value="themeColor" @input="previewThemeColor($event.target.value)"
-                            @change="saveThemeColor($event.target.value)"
-                            aria-label="Custom theme color"
-                            class="absolute inset-0 z-10 h-full w-full cursor-pointer opacity-0" />
-                    </div>
-                @else
-                    <button type="button" @click="setTheme('{{ $option['value'] }}')"
-                        class="flex h-8 w-full items-center justify-between rounded-md px-2 text-left text-xs text-neutral-600 transition-colors hover:bg-neutral-200 hover:text-neutral-950 dark:text-fg-dim dark:hover:bg-white/[0.06] dark:hover:text-fg">
-                        <span>{{ $option['label'] }}</span>
-                        <svg x-show="theme === '{{ $option['value'] }}'"
-                            class="size-3.5 text-coollabs dark:text-warning" viewBox="0 0 12 12" fill="none"
-                            aria-hidden="true">
-                            <path d="m2.5 6.25 2.1 2.1 4.9-5" stroke="currentColor" stroke-width="1.4"
-                                stroke-linecap="round" stroke-linejoin="round" />
-                        </svg>
-                    </button>
-                @endif
-            @endforeach
-            <div class="my-1 h-px bg-neutral-200 dark:bg-white/[0.07]"></div>
-            <div class="px-2 pt-1 pb-0.5 text-[10px] font-medium tracking-wide text-neutral-400 uppercase dark:text-fg-faint">
-                Page width
-            </div>
-            @foreach ([
-                ['value' => 'full', 'label' => 'Full width'],
-                ['value' => 'centered', 'label' => 'Centered'],
-            ] as $option)
-                <button type="button" @click="setWidth('{{ $option['value'] }}')"
-                    class="flex h-8 w-full items-center justify-between rounded-md px-2 text-left text-xs text-neutral-600 transition-colors hover:bg-neutral-200 hover:text-neutral-950 dark:text-fg-dim dark:hover:bg-white/[0.06] dark:hover:text-fg">
-                    <span>{{ $option['label'] }}</span>
-                    <svg x-show="pageWidth === '{{ $option['value'] }}'"
-                        class="size-3.5 text-coollabs dark:text-warning" viewBox="0 0 12 12" fill="none"
-                        aria-hidden="true">
-                        <path d="m2.5 6.25 2.1 2.1 4.9-5" stroke="currentColor" stroke-width="1.4"
-                            stroke-linecap="round" stroke-linejoin="round" />
-                    </svg>
-                </button>
-            @endforeach
+        <div x-show="appearanceOpen" x-collapse.duration.200ms class="mx-1 pb-1 pl-6">
+            <x-theme-controls variant="menu" />
         </div>
 
+        <button type="button" class="listbox-option w-full" @click="toggleAutoCollapse()"
+            :aria-pressed="autoCollapse" title="Collapse the sidebar on pages that have a settings menu">
+            <span class="flex items-center gap-2">
+                <svg class="size-4 opacity-80" viewBox="0 0 24 24" fill="none" aria-hidden="true">
+                    <rect x="3" y="4" width="18" height="16" rx="2" stroke="currentColor" stroke-width="1.6" />
+                    <path d="M9 4v16" stroke="currentColor" stroke-width="1.6" />
+                </svg>
+                Auto-collapse sidebar
+            </span>
+            <svg x-show="autoCollapse" x-cloak class="size-4 shrink-0 text-black dark:text-fg" viewBox="0 0 24 24"
+                fill="none" aria-hidden="true">
+                <path d="M5 12l5 5L20 7" stroke="currentColor" stroke-width="2" stroke-linecap="round"
+                    stroke-linejoin="round" />
+            </svg>
+        </button>
+
         <div class="my-1 h-px bg-neutral-200 dark:bg-white/[0.07]"></div>
 
         <livewire:settings-dropdown trigger="account-menu" />
diff --git a/resources/views/components/unsaved-bar.blade.php b/resources/views/components/unsaved-bar.blade.php
index 8d029c2fb3..cbc137e07b 100644
--- a/resources/views/components/unsaved-bar.blade.php
+++ b/resources/views/components/unsaved-bar.blade.php
@@ -5,6 +5,8 @@
     // appears when those fields differ from the last server snapshot — not on
     // incidental component state (e.g. $wire.set from x-init, display-only props).
     'targets' => null,
+    // Optional Alpine expression for drafts that survive unrelated server requests.
+    'dirty' => null,
 ])
 
 {{-- Floating "unsaved changes" pill (bottom center). Reveals itself via
@@ -40,7 +42,8 @@
         window.visualViewport?.removeEventListener('scroll', this.updateKeyboardInset);
         window.removeEventListener('resize', this.updateKeyboardInset);
     },
-}" x-bind:style="`--keyboard-inset: ${keyboardInset}px`" wire:dirty.class="is-dirty"
+}" x-bind:style="`--keyboard-inset: ${keyboardInset}px`"
+    @if ($dirty) x-bind:class="{ 'is-dirty': {{ $dirty }} }" @else wire:dirty.class="is-dirty" @endif
     wire:loading.class="is-saving"
     @keydown.enter.window="
         if ($el.classList.contains('is-dirty') &&
diff --git a/resources/views/components/upgrade-progress.blade.php b/resources/views/components/upgrade-progress.blade.php
index fec9ce2d1c..68b250c1f2 100644
--- a/resources/views/components/upgrade-progress.blade.php
+++ b/resources/views/components/upgrade-progress.blade.php
@@ -20,7 +20,7 @@
 
 <div class="w-full">
     <div
-        class="grid grid-cols-4 overflow-hidden rounded-[10px] border border-neutral-200 bg-white dark:border-white/[0.08] dark:bg-white/[0.025]">
+        class="grid grid-cols-4 overflow-hidden rounded-[10px] border border-neutral-200 bg-white dark:border-white/[0.08] dark:bg-white/[0.05]">
         @foreach ($steps as $stepNumber => $label)
             <div
                 class="flex min-h-10 items-center justify-center gap-2 border-r border-neutral-200 px-2 text-[11px] font-medium last:border-r-0 dark:border-white/[0.08] sm:px-3"
diff --git a/resources/views/emails/backup-missing.blade.php b/resources/views/emails/backup-missing.blade.php
new file mode 100644
index 0000000000..69728c26f3
--- /dev/null
+++ b/resources/views/emails/backup-missing.blade.php
@@ -0,0 +1,7 @@
+The enabled backup schedule for {{ $database_name }} has produced no executions in the last {{ $days }} day(s).
+
+@if ($last_execution_at)
+The last execution was at {{ $last_execution_at }}.
+@else
+This schedule has never produced an execution.
+@endif
diff --git a/resources/views/layouts/app.blade.php b/resources/views/layouts/app.blade.php
index a7de0b6804..43efef4b50 100644
--- a/resources/views/layouts/app.blade.php
+++ b/resources/views/layouts/app.blade.php
@@ -9,21 +9,48 @@
     @auth
         <div x-data="{
             open: false,
-            collapsed: localStorage.getItem('sidebarCollapsed') === 'true',
+            userCollapsed: localStorage.getItem('sidebarCollapsed') === 'true',
+            autoCollapse: localStorage.getItem('sidebarAutoCollapse') !== 'false',
+            hasSecondBar: false,
+            collapsed: false,
             pageWidth: localStorage.getItem('pageWidth') || 'full',
             sidebarReady: false,
             init() {
+                this.applyCollapsed(false);
                 this.$nextTick(() => {
                     requestAnimationFrame(() => {
                         this.sidebarReady = true;
                     });
                 });
             },
+            targetCollapsed() {
+                this.hasSecondBar = !!document.querySelector('.application-settings-navigation');
+                return this.userCollapsed || (this.autoCollapse && this.hasSecondBar);
+            },
+            applyCollapsed(animate) {
+                const target = this.targetCollapsed();
+                if (target === this.collapsed) return;
+                if (animate) {
+                    // Let the new page paint at the current width, then animate the
+                    // slide a frame later so the auto-collapse reads as a motion.
+                    this.sidebarReady = true;
+                    requestAnimationFrame(() => requestAnimationFrame(() => { this.collapsed = target; }));
+                } else {
+                    this.collapsed = target;
+                }
+            },
             toggleSidebar() {
                 this.collapsed = !this.collapsed;
-                localStorage.setItem('sidebarCollapsed', this.collapsed);
+                this.userCollapsed = this.collapsed;
+                localStorage.setItem('sidebarCollapsed', this.userCollapsed);
+            },
+            toggleAutoCollapse() {
+                this.autoCollapse = !this.autoCollapse;
+                localStorage.setItem('sidebarAutoCollapse', this.autoCollapse);
+                this.applyCollapsed(true);
             }
-        }" @open-global-search.window="open = false" @page-width-changed.window="pageWidth = $event.detail" x-cloak
+        }" @open-global-search.window="open = false" @page-width-changed.window="pageWidth = $event.detail" x-on:livewire:navigated.window="applyCollapsed(true)"
+            :style="{ '--sidebar-w': collapsed ? '4rem' : '14rem' }" x-cloak
             class="dark:text-inherit text-black">
             <livewire:deployments-indicator />
 
@@ -69,29 +96,42 @@
                 </div>
             </header>
 
-            {{-- ============ MOBILE SLIDE-OVER SIDEBAR ============ --}}
-            <div class="relative z-[1000] lg:hidden" :class="open ? 'block' : 'hidden'" role="dialog" aria-modal="true">
-                <div class="fixed inset-0 bg-black/80" x-on:click="open = false"></div>
-                <div class="fixed inset-y-0 right-0 flex h-full">
-                    <div
-                        class="relative flex h-full w-full max-w-56 min-w-0 flex-col border-l border-neutral-200 bg-white shadow-xl dark:border-white/[0.12] dark:bg-panel">
-                        <div class="absolute top-0 right-full flex w-16 justify-center pt-5">
-                            <button type="button" class="-m-2.5 p-2.5" x-on:click="open = !open">
-                                <span class="sr-only">Close sidebar</span>
-                                <svg class="h-6 w-6 text-white" fill="none" viewBox="0 0 24 24" stroke-width="1.5"
+            {{-- ============ MOBILE SLIDE-OVER SIDEBAR (shadcn-style sheet) ============ --}}
+            <div class="mobile-sidebar-sheet relative z-[1000] lg:hidden"
+                x-on:keydown.escape.window="open = false"
+                x-on:livewire:navigated.window="open = false">
+                {{-- Scrim: fades in/out --}}
+                <div class="fixed inset-0 bg-black/50" x-show="open" x-cloak x-on:click="open = false"
+                    x-transition:enter="transition-opacity ease-out duration-300"
+                    x-transition:enter-start="opacity-0" x-transition:enter-end="opacity-100"
+                    x-transition:leave="transition-opacity ease-in duration-200"
+                    x-transition:leave-start="opacity-100" x-transition:leave-end="opacity-0"></div>
+                {{-- Panel: slides in from the right (iOS drawer curve), exits faster --}}
+                <div class="fixed inset-y-0 right-0 flex" :class="!open && 'pointer-events-none'">
+                    <div x-show="open" x-cloak x-trap.inert.noscroll="open"
+                        role="dialog" aria-modal="true" aria-label="Navigation menu"
+                        x-transition:enter="transform transition ease-[cubic-bezier(0.32,0.72,0,1)] duration-300"
+                        x-transition:enter-start="translate-x-full" x-transition:enter-end="translate-x-0"
+                        x-transition:leave="transform transition ease-in duration-200"
+                        x-transition:leave-start="translate-x-0" x-transition:leave-end="translate-x-full"
+                        class="relative flex h-full w-72 max-w-[85vw] min-w-0 flex-col overflow-hidden rounded-l-2xl border-l border-neutral-200 bg-white shadow-[-8px_0_30px_-6px_rgba(0,0,0,0.18)] dark:border-white/[0.12] dark:bg-panel dark:shadow-[-8px_0_30px_-4px_rgba(0,0,0,0.5)]">
+                        <div data-mobile-sidebar-brand
+                            class="flex h-12 shrink-0 items-center justify-between gap-1.5 border-b border-neutral-200 px-4 dark:border-white/[0.06]">
+                            <div class="flex min-w-0 items-baseline gap-1.5">
+                                <a href="/" {{ wireNavigate() }} title="Coolify"
+                                    class="text-[15px] font-semibold tracking-tight text-black transition-opacity hover:opacity-80 dark:text-white">
+                                    Coolify
+                                </a>
+                                <x-version class="!text-[10.5px] font-medium text-neutral-400 dark:text-fg-faint !opacity-100 hover:!opacity-100 hover:text-black dark:hover:text-fg" />
+                            </div>
+                            <button type="button" x-on:click="open = false" aria-label="Close menu"
+                                class="-mr-1.5 flex size-8 shrink-0 items-center justify-center rounded-md text-neutral-500 transition-colors hover:bg-neutral-100 hover:text-black active:scale-95 dark:text-fg-dim dark:hover:bg-white/[0.06] dark:hover:text-fg">
+                                <svg class="size-5" fill="none" viewBox="0 0 24 24" stroke-width="1.75"
                                     stroke="currentColor" aria-hidden="true">
                                     <path stroke-linecap="round" stroke-linejoin="round" d="M6 18L18 6M6 6l12 12" />
                                 </svg>
                             </button>
                         </div>
-                        <div data-mobile-sidebar-brand
-                            class="flex h-12 shrink-0 items-center gap-1.5 border-b border-neutral-200 px-4 dark:border-white/[0.06]">
-                            <a href="/" {{ wireNavigate() }} title="Coolify"
-                                class="text-[15px] font-semibold tracking-tight text-black transition-opacity hover:opacity-80 dark:text-white">
-                                Coolify
-                            </a>
-                            <x-version class="!text-[10.5px] font-medium text-neutral-400 dark:text-fg-faint !opacity-100 hover:!opacity-100 hover:text-black dark:hover:text-fg" />
-                        </div>
                         <div class="flex min-h-0 min-w-0 flex-1 flex-col overflow-y-auto pb-2 scrollbar">
                             <x-navbar />
                         </div>
@@ -128,11 +168,12 @@
                         <livewire:upgrade key="mobile-upgrade" />
                     @endif
                     <x-top-user-menu />
-                    <button type="button" class="-m-1 p-2 text-neutral-500 dark:text-fg-dim" x-on:click="open = !open">
+                    <button type="button" x-on:click="open = !open"
+                        class="-mr-1 flex size-9 items-center justify-center rounded-md text-neutral-500 transition-transform duration-100 ease-out hover:bg-neutral-100 hover:text-black active:scale-90 dark:text-fg-dim dark:hover:bg-white/[0.06] dark:hover:text-fg">
                         <span class="sr-only">Open sidebar</span>
-                        <svg class="w-6 h-6" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
-                            <path fill="none" stroke="currentColor" stroke-linecap="round" stroke-linejoin="round"
-                                stroke-width="2" d="M4 6h16M4 12h16M4 18h16" />
+                        <svg class="size-5" viewBox="0 0 24 24" fill="none" aria-hidden="true">
+                            <rect x="3" y="4" width="18" height="16" rx="2" stroke="currentColor" stroke-width="1.6" />
+                            <path d="M9 4v16" stroke="currentColor" stroke-width="1.6" />
                         </svg>
                     </button>
                 </div>
@@ -140,7 +181,7 @@
 
             {{-- ============ MAIN ============ --}}
             <main
-                class="min-h-screen bg-white dark:bg-panel px-5 py-6 sm:px-8 lg:px-10 lg:pt-[calc(3rem+1.75rem)] lg:pb-10"
+                class="min-h-screen bg-neutral-50 dark:bg-app px-5 py-6 sm:px-8 lg:px-10 lg:pt-[calc(3rem+1.75rem)] lg:pb-10"
                 :class="[collapsed ? 'lg:ml-16' : 'lg:ml-56', sidebarReady ? 'transition-[margin] duration-200' : '']">
                 <div class="w-full" :class="pageWidth === 'centered' ? 'mx-auto max-w-[1400px]' : 'max-w-none'">
                     {{ $slot }}
diff --git a/resources/views/layouts/base.blade.php b/resources/views/layouts/base.blade.php
index a97d8c1df7..ffeefb587f 100644
--- a/resources/views/layouts/base.blade.php
+++ b/resources/views/layouts/base.blade.php
@@ -3,6 +3,22 @@
 <script data-navigate-once>
     // Immediate theme application - runs before any rendering
     (function () {
+        // The OS color picker only speaks hex. Convert it once so the whole theme
+        // cascade is authored in OKLCH (sRGB -> linear -> OKLab -> OKLCH).
+        const srgbToLinear = (c) => c <= 0.04045 ? c / 12.92 : ((c + 0.055) / 1.055) ** 2.4;
+        window.hexToOklch = (hex) => {
+            const [r, g, b] = hex.match(/[a-f\d]{2}/gi).map((channel) => srgbToLinear(parseInt(channel, 16) / 255));
+            const l = Math.cbrt(0.4122214708 * r + 0.5363325363 * g + 0.0514459929 * b);
+            const m = Math.cbrt(0.2119034982 * r + 0.6806995451 * g + 0.1073969566 * b);
+            const s = Math.cbrt(0.0883024619 * r + 0.2817188376 * g + 0.6299787005 * b);
+            const okL = 0.2104542553 * l + 0.7936177850 * m - 0.0040720468 * s;
+            const okA = 1.9779984951 * l - 2.4285922050 * m + 0.4505937099 * s;
+            const okB = 0.0259040371 * l + 0.7827717662 * m - 0.8086757660 * s;
+            const chroma = Math.sqrt(okA * okA + okB * okB);
+            let hue = Math.atan2(okB, okA) * 180 / Math.PI;
+            if (hue < 0) hue += 360;
+            return `oklch(${(okL * 100).toFixed(2)}% ${chroma.toFixed(4)} ${hue.toFixed(2)})`;
+        };
         window.themeAccentForeground = (color) => {
             const channels = color.match(/[a-f\d]{2}/gi).map(channel => parseInt(channel, 16) * 0.85 + 255 * 0.15);
             const luminance = channels
@@ -10,20 +26,93 @@
                 .map(channel => channel <= 0.04045 ? channel / 12.92 : ((channel + 0.055) / 1.055) ** 2.4)
                 .reduce((sum, channel, index) => sum + channel * [0.2126, 0.7152, 0.0722][index], 0);
 
-            return luminance > 0.179 ? '#000000' : '#ffffff';
+            return luminance > 0.179 ? 'oklch(0% 0 0)' : 'oklch(100% 0 0)';
         };
         window.applyStoredTheme = () => {
             const theme = localStorage.theme === 'purple' ? 'custom' : (localStorage.theme || 'dark');
             const themeColor = localStorage.themeColor || '#6b16ed';
-            const isDark = theme === 'dark' || theme === 'custom' || (theme === 'system' && matchMedia('(prefers-color-scheme: dark)').matches);
+            const customMode = localStorage.customMode || 'dark';
+            const isDark = theme === 'dark'
+                || (theme === 'custom' && customMode === 'dark')
+                || (theme === 'system' && matchMedia('(prefers-color-scheme: dark)').matches);
 
             localStorage.theme = theme;
             document.documentElement.classList.toggle('dark', isDark);
             document.documentElement.dataset.theme = theme === 'custom' ? 'custom' : (isDark ? 'dark' : 'light');
-            document.documentElement.style.setProperty('--theme-base-color', themeColor);
+            document.documentElement.style.setProperty('--theme-base-color', window.hexToOklch(themeColor));
             document.documentElement.style.setProperty('--theme-accent-foreground', window.themeAccentForeground(themeColor));
             document.querySelector('meta[name=theme-color]')?.setAttribute('content', isDark ? '#101010' : '#ffffff');
         };
+        // Single source for the theme controls Alpine state, shared by the
+        // Appearance page and the profile dropdown via x-data="themeControls()".
+        window.themeControls = () => ({
+            theme: localStorage.getItem('theme') === 'purple' ? 'custom' : (localStorage.getItem('theme') || 'dark'),
+            themeColor: localStorage.getItem('themeColor') || '#6b16ed',
+            customMode: localStorage.getItem('customMode') || 'dark',
+            pageWidth: localStorage.getItem('pageWidth') || 'full',
+            themeColorFrame: null,
+            pickerOpen: false,
+            init() {
+                localStorage.setItem('theme', this.theme);
+                this.applyTheme();
+            },
+            chooseCustom() {
+                this.setTheme('custom');
+                this.pickerOpen = !this.pickerOpen;
+            },
+            setTheme(type) {
+                this.theme = type;
+                localStorage.setItem('theme', type);
+                this.applyTheme();
+            },
+            setCustomMode(mode) {
+                this.customMode = mode;
+                localStorage.setItem('customMode', mode);
+                if (this.theme !== 'custom') {
+                    this.setTheme('custom');
+                    return;
+                }
+                this.applyTheme();
+            },
+            setWidth(width) {
+                this.pageWidth = width;
+                localStorage.setItem('pageWidth', width);
+                window.dispatchEvent(new CustomEvent('page-width-changed', { detail: width }));
+            },
+            previewThemeColor(color) {
+                this.themeColor = color;
+                if (this.theme !== 'custom') {
+                    this.theme = 'custom';
+                    localStorage.setItem('theme', 'custom');
+                }
+                document.documentElement.dataset.theme = 'custom';
+                document.documentElement.classList.toggle('dark', this.customMode === 'dark');
+                if (this.themeColorFrame) {
+                    return;
+                }
+                this.themeColorFrame = requestAnimationFrame(() => {
+                    document.documentElement.style.setProperty('--theme-base-color', window.hexToOklch(this.themeColor));
+                    document.documentElement.style.setProperty('--theme-accent-foreground', window.themeAccentForeground(this.themeColor));
+                    this.themeColorFrame = null;
+                });
+            },
+            saveThemeColor(color) {
+                this.previewThemeColor(color);
+                localStorage.setItem('themeColor', color);
+                localStorage.setItem('theme', 'custom');
+            },
+            applyTheme() {
+                const prefersDark = window.matchMedia('(prefers-color-scheme: dark)').matches;
+                const isDark = this.theme === 'dark'
+                    || (this.theme === 'custom' && this.customMode === 'dark')
+                    || (this.theme === 'system' && prefersDark);
+                document.documentElement.classList.toggle('dark', isDark);
+                document.documentElement.dataset.theme = this.theme === 'custom' ? 'custom' : (isDark ? 'dark' : 'light');
+                document.documentElement.style.setProperty('--theme-base-color', window.hexToOklch(this.themeColor));
+                document.documentElement.style.setProperty('--theme-accent-foreground', window.themeAccentForeground(this.themeColor));
+                document.querySelector('meta[name=theme-color]')?.setAttribute('content', isDark ? '#101010' : '#ffffff');
+            },
+        });
 
         document.addEventListener('livewire:navigated', window.applyStoredTheme);
         window.applyStoredTheme();
@@ -95,7 +184,7 @@
 </head>
 @section('body')
 
-<body class="overflow-y-scroll dark:text-inherit text-black">
+<body class="dark:text-inherit text-black">
     <x-toast />
     <x-icon-tooltip />
     <script data-navigate-once>
diff --git a/resources/views/layouts/simple.blade.php b/resources/views/layouts/simple.blade.php
index e927e300c6..06062370ba 100644
--- a/resources/views/layouts/simple.blade.php
+++ b/resources/views/layouts/simple.blade.php
@@ -4,7 +4,7 @@
          styles (e.g. [wire\:loading] { display: none }) must be rendered manually too. --}}
     @livewireStyles
     @livewireScripts
-    <main class="h-full bg-gray-50 dark:bg-base">
+    <main class="h-full bg-neutral-50 dark:bg-base">
         {{ $slot }}
     </main>
     @parent
diff --git a/resources/views/livewire/boarding/index.blade.php b/resources/views/livewire/boarding/index.blade.php
index 2f955f1673..bc22715931 100644
--- a/resources/views/livewire/boarding/index.blade.php
+++ b/resources/views/livewire/boarding/index.blade.php
@@ -40,7 +40,7 @@
                             Continue
                         </x-forms.button>
                         <div
-                            class="inline-flex flex-wrap items-center justify-center gap-0.5 rounded-lg border border-neutral-200 bg-neutral-50 p-0.5 dark:border-white/[0.08] dark:bg-white/[0.025]">
+                            class="inline-flex flex-wrap items-center justify-center gap-0.5 rounded-lg border border-neutral-200 bg-neutral-50 p-0.5 dark:border-white/[0.08] dark:bg-white/[0.05]">
                             <button type="button" wire:click="skipBoarding"
                                 class="inline-flex items-center gap-1.5 rounded-md px-3 py-1.5 text-[12px] font-medium text-neutral-500 transition-colors hover:bg-white hover:text-coollabs dark:text-fg-dim dark:hover:bg-white/[0.06] dark:hover:text-warning">
                                 <x-reicon name="arrow-right" class="size-3.5 shrink-0" />
@@ -101,7 +101,7 @@
                                 <p class="mb-3 text-sm text-neutral-500 dark:text-neutral-400">Use this machine or connect a server you already manage.</p>
                                 <div class="grid w-full grid-cols-1 gap-4 lg:grid-cols-2">
                             <button
-                                class="group relative cursor-pointer min-h-36 rounded-[10px] border border-neutral-200 bg-white p-4 text-left shadow-sm transition-all hover:-translate-y-px hover:border-neutral-300 hover:shadow-md dark:border-white/[0.08] dark:bg-white/[0.025] dark:hover:border-white/[0.14]"
+                                class="group relative cursor-pointer min-h-36 rounded-[10px] border border-neutral-200 bg-white p-4 text-left shadow-sm transition-all hover:-translate-y-px hover:border-neutral-300 hover:shadow-md dark:border-white/[0.08] dark:bg-white/[0.05] dark:hover:border-white/[0.14]"
                                 wire:target="setServerType('localhost')" wire:click="setServerType('localhost')">
                                 <span role="button" tabindex="0" aria-label="About this machine"
                                     data-tooltip="The machine running Coolify. Not recommended for production workloads due to resource contention."
@@ -125,7 +125,7 @@
 
 
                             <button
-                                class="group relative cursor-pointer min-h-36 rounded-[10px] border border-neutral-200 bg-white p-4 text-left shadow-sm transition-all hover:-translate-y-px hover:border-neutral-300 hover:shadow-md dark:border-white/[0.08] dark:bg-white/[0.025] dark:hover:border-white/[0.14]"
+                                class="group relative cursor-pointer min-h-36 rounded-[10px] border border-neutral-200 bg-white p-4 text-left shadow-sm transition-all hover:-translate-y-px hover:border-neutral-300 hover:shadow-md dark:border-white/[0.08] dark:bg-white/[0.05] dark:hover:border-white/[0.14]"
                                 wire:target="setServerType('remote')" wire:click="setServerType('remote')">
                                 <span role="button" tabindex="0" aria-label="About remote servers"
                                     data-tooltip="Any SSH-accessible server, including cloud VPS, bare metal, and self-hosted infrastructure."
@@ -157,7 +157,7 @@
                                     <x-modal-input title="Connect a Hetzner Server" isFullWidth>
                                         <x-slot:content>
                                             <div
-                                                class="group relative cursor-pointer flex h-full min-h-36 flex-col rounded-[10px] border border-neutral-200 bg-white p-4 text-left shadow-sm transition-all hover:-translate-y-px hover:border-neutral-300 hover:shadow-md dark:border-white/[0.08] dark:bg-white/[0.025] dark:hover:border-white/[0.14]">
+                                                class="group relative cursor-pointer flex h-full min-h-36 flex-col rounded-[10px] border border-neutral-200 bg-white p-4 text-left shadow-sm transition-all hover:-translate-y-px hover:border-neutral-300 hover:shadow-md dark:border-white/[0.08] dark:bg-white/[0.05] dark:hover:border-white/[0.14]">
                                                 <div class="flex h-full flex-col gap-4 text-left">
                                                     <img src="{{ asset('svgs/hetzner.svg') }}" alt="Hetzner"
                                                         class="size-10 shrink-0">
@@ -175,7 +175,7 @@
                                     <x-modal-input title="Connect a Vultr Server" isFullWidth>
                                         <x-slot:content>
                                             <div
-                                                class="group relative cursor-pointer flex h-full min-h-36 flex-col rounded-[10px] border border-neutral-200 bg-white p-4 text-left shadow-sm transition-all hover:-translate-y-px hover:border-neutral-300 hover:shadow-md dark:border-white/[0.08] dark:bg-white/[0.025] dark:hover:border-white/[0.14]">
+                                                class="group relative cursor-pointer flex h-full min-h-36 flex-col rounded-[10px] border border-neutral-200 bg-white p-4 text-left shadow-sm transition-all hover:-translate-y-px hover:border-neutral-300 hover:shadow-md dark:border-white/[0.08] dark:bg-white/[0.05] dark:hover:border-white/[0.14]">
                                                 <div class="flex h-full flex-col gap-4 text-left">
                                                     <img src="https://www.vultr.com/media/logo_ondark.svg" alt="Vultr"
                                                         class="h-10 w-28 shrink-0 object-contain object-left">
@@ -193,7 +193,7 @@
                                     <x-modal-input title="Connect a DigitalOcean Server" isFullWidth>
                                         <x-slot:content>
                                             <div
-                                                class="group relative cursor-pointer flex h-full min-h-36 flex-col rounded-[10px] border border-neutral-200 bg-white p-4 text-left shadow-sm transition-all hover:-translate-y-px hover:border-neutral-300 hover:shadow-md dark:border-white/[0.08] dark:bg-white/[0.025] dark:hover:border-white/[0.14]">
+                                                class="group relative cursor-pointer flex h-full min-h-36 flex-col rounded-[10px] border border-neutral-200 bg-white p-4 text-left shadow-sm transition-all hover:-translate-y-px hover:border-neutral-300 hover:shadow-md dark:border-white/[0.08] dark:bg-white/[0.05] dark:hover:border-white/[0.14]">
                                                 <div class="flex h-full flex-col gap-4 text-left">
                                                     <x-digital-ocean-icon class="size-10 shrink-0" />
                                                     <div class="min-h-0 flex-1">
@@ -279,7 +279,7 @@
                             @endphp
                             <div class="w-full space-y-4">
                                 <div
-                                    class="rounded-[10px] border border-neutral-200 bg-neutral-50 p-4 dark:border-white/[0.08] dark:bg-white/[0.025]">
+                                    class="rounded-[10px] border border-neutral-200 bg-neutral-50 p-4 dark:border-white/[0.08] dark:bg-white/[0.05]">
                                     <form wire:submit="selectExistingPrivateKey"
                                         class="flex flex-col gap-3 sm:flex-row sm:items-end">
                                         <div class="min-w-0 flex-1">
@@ -304,7 +304,7 @@
                         @endif
                         <div class="grid w-full grid-cols-1 gap-3 lg:grid-cols-2">
                             <button type="button"
-                                class="group flex h-full min-h-28 items-start gap-3 rounded-[10px] border border-neutral-200 bg-white p-4 text-left shadow-sm transition-all hover:-translate-y-px hover:border-neutral-300 hover:shadow-md dark:border-white/[0.08] dark:bg-white/[0.025] dark:hover:border-white/[0.14]"
+                                class="group flex h-full min-h-28 items-start gap-3 rounded-[10px] border border-neutral-200 bg-white p-4 text-left shadow-sm transition-all hover:-translate-y-px hover:border-neutral-300 hover:shadow-md dark:border-white/[0.08] dark:bg-white/[0.05] dark:hover:border-white/[0.14]"
                                 wire:target="setPrivateKey('own')" wire:click="setPrivateKey('own')">
                                 <span
                                     class="flex size-9 shrink-0 items-center justify-center rounded-lg border border-neutral-200 bg-neutral-50 text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.035] dark:text-fg-dim">
@@ -318,7 +318,7 @@
                                 </span>
                             </button>
                             <button type="button"
-                                class="group flex h-full min-h-28 items-start gap-3 rounded-[10px] border border-neutral-200 bg-white p-4 text-left shadow-sm transition-all hover:-translate-y-px hover:border-neutral-300 hover:shadow-md dark:border-white/[0.08] dark:bg-white/[0.025] dark:hover:border-white/[0.14]"
+                                class="group flex h-full min-h-28 items-start gap-3 rounded-[10px] border border-neutral-200 bg-white p-4 text-left shadow-sm transition-all hover:-translate-y-px hover:border-neutral-300 hover:shadow-md dark:border-white/[0.08] dark:bg-white/[0.05] dark:hover:border-white/[0.14]"
                                 wire:target="setPrivateKey('create')" wire:click="setPrivateKey('create')">
                                 <span
                                     class="flex size-9 shrink-0 items-center justify-center rounded-lg border border-neutral-200 bg-neutral-50 text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.035] dark:text-fg-dim">
@@ -597,7 +597,7 @@
                             Deploy your first resource
                         </x-forms.button>
                         <div
-                            class="inline-flex flex-wrap items-center justify-center gap-0.5 rounded-lg border border-neutral-200 bg-neutral-50 p-0.5 dark:border-white/[0.08] dark:bg-white/[0.025]">
+                            class="inline-flex flex-wrap items-center justify-center gap-0.5 rounded-lg border border-neutral-200 bg-neutral-50 p-0.5 dark:border-white/[0.08] dark:bg-white/[0.05]">
                             <button type="button" wire:click="skipBoarding"
                                 class="inline-flex items-center gap-1.5 rounded-md px-3 py-1.5 text-[12px] font-medium text-neutral-500 transition-colors hover:bg-white hover:text-coollabs dark:text-fg-dim dark:hover:bg-white/[0.06] dark:hover:text-warning">
                                 <x-reicon name="arrow-right" class="size-3.5 shrink-0" />
@@ -622,7 +622,7 @@
         @if ($currentState !== 'welcome' && $currentState !== 'create-resource')
             <div class="mx-auto mt-6 flex w-full max-w-3xl flex-col items-center gap-3">
                 <div
-                    class="inline-flex flex-wrap items-center justify-center gap-0.5 rounded-lg border border-neutral-200 bg-neutral-50 p-0.5 dark:border-white/[0.08] dark:bg-white/[0.025]">
+                    class="inline-flex flex-wrap items-center justify-center gap-0.5 rounded-lg border border-neutral-200 bg-neutral-50 p-0.5 dark:border-white/[0.08] dark:bg-white/[0.05]">
                     <button type="button" wire:click="skipBoarding"
                         class="inline-flex items-center gap-1.5 rounded-md px-3 py-1.5 text-[12px] font-medium text-neutral-500 transition-colors hover:bg-white hover:text-coollabs dark:text-fg-dim dark:hover:bg-white/[0.06] dark:hover:text-warning">
                         <x-reicon name="arrow-right" class="size-3.5 shrink-0" />
diff --git a/resources/views/livewire/dashboard.blade.php b/resources/views/livewire/dashboard.blade.php
index ebee5d2a34..f4bf96fbb7 100644
--- a/resources/views/livewire/dashboard.blade.php
+++ b/resources/views/livewire/dashboard.blade.php
@@ -17,21 +17,8 @@
         <livewire:dashboard.active-deployments />
 
         <section class="mb-0! min-w-0">
-            <div class="mb-3 flex items-end justify-between gap-4">
-                <div>
-                    <h2 class="text-[14px]! leading-5! font-semibold! text-black dark:text-fg">
-                        Projects
-                    </h2>
-                    <p class="mt-0.5 text-[11px] text-neutral-500 dark:text-fg-faint">
-                        Your deployment workspaces
-                    </p>
-                </div>
-                <a href="{{ route('project.index') }}" {{ wireNavigate() }}
-                    class="inline-flex shrink-0 items-center gap-1 text-[12px] font-medium text-neutral-500 transition-colors hover:text-black dark:text-fg-dim dark:hover:text-fg">
-                    View all
-                    <x-reicon name="arrow-right" class="size-3" />
-                </a>
-            </div>
+            <x-section-heading title="Projects" subtitle="Your deployment workspaces"
+                :href="route('project.index')" />
 
             @if ($dashboardProjects->isEmpty())
                 <x-empty title="No projects yet"
@@ -57,7 +44,7 @@
                         @endphp
 
                         <article
-                            class="group relative flex min-h-28 min-w-0 flex-col rounded-xl border border-neutral-200 bg-white p-3 shadow-sm transition-all hover:-translate-y-px hover:border-neutral-300 hover:shadow-md dark:border-white/[0.08] dark:bg-white/[0.025] dark:hover:border-white/[0.14]">
+                            class="group relative flex min-h-28 min-w-0 flex-col rounded-xl border border-neutral-200 bg-white p-3 shadow-sm transition-all hover:-translate-y-px hover:border-neutral-300 hover:shadow-md dark:border-white/[0.08] dark:bg-white/[0.05] dark:hover:border-white/[0.14]">
                             <a href="{{ $project->navigateTo() }}" {{ wireNavigate() }}
                                 class="absolute inset-0 rounded-xl"
                                 aria-label="Open {{ $project->name }}"></a>
@@ -125,21 +112,8 @@
         </section>
 
         <section class="mb-0! min-w-0">
-            <div class="mb-3 flex items-end justify-between gap-4">
-                <div>
-                    <h2 class="text-[14px]! leading-5! font-semibold! text-black dark:text-fg">
-                        Servers
-                    </h2>
-                    <p class="mt-0.5 text-[11px] text-neutral-500 dark:text-fg-faint">
-                        Infrastructure available for deployments
-                    </p>
-                </div>
-                <a href="{{ route('server.index') }}" {{ wireNavigate() }}
-                    class="inline-flex shrink-0 items-center gap-1 text-[12px] font-medium text-neutral-500 transition-colors hover:text-black dark:text-fg-dim dark:hover:text-fg">
-                    View all
-                    <x-reicon name="arrow-right" class="size-3" />
-                </a>
-            </div>
+            <x-section-heading title="Servers" subtitle="Infrastructure available for deployments"
+                :href="route('server.index')" />
 
             @if ($dashboardServers->isEmpty())
                 @if ($privateKeys->isEmpty())
@@ -190,7 +164,7 @@
 
                         <a href="{{ route('server.show', ['server_uuid' => $server->uuid]) }}"
                             {{ wireNavigate() }} aria-label="Open {{ $server->name }}"
-                            class="group relative flex min-h-28 min-w-0 flex-col rounded-xl border border-neutral-200 bg-white p-3 shadow-sm transition-all hover:-translate-y-px hover:border-neutral-300 hover:shadow-md dark:border-white/[0.08] dark:bg-white/[0.025] dark:hover:border-white/[0.14]">
+                            class="group relative flex min-h-28 min-w-0 flex-col rounded-xl border border-neutral-200 bg-white p-3 shadow-sm transition-all hover:-translate-y-px hover:border-neutral-300 hover:shadow-md dark:border-white/[0.08] dark:bg-white/[0.05] dark:hover:border-white/[0.14]">
                             @if ($server->isMetricsEnabled())
                                 <livewire:dashboard.server-metrics-chart :server="$server"
                                     :key="'dashboard-server-metrics-'.$server->uuid" />
diff --git a/resources/views/livewire/dashboard/active-deployments.blade.php b/resources/views/livewire/dashboard/active-deployments.blade.php
index 3aa481a082..cea0489a20 100644
--- a/resources/views/livewire/dashboard/active-deployments.blade.php
+++ b/resources/views/livewire/dashboard/active-deployments.blade.php
@@ -24,24 +24,15 @@
     $hasAnyDeployments = $hasActiveDeployments || $hasRecentDeployments;
 @endphp
 
-<div wire:poll.3000ms="refreshDeployments" @class(['mb-0! min-w-0' => $hasAnyDeployments])>
+<div wire:poll.3000ms="refreshDeployments" @class(['mb-0! min-w-0' => $hasAnyDeployments, 'hidden' => ! $hasAnyDeployments])>
     @if ($hasAnyDeployments)
         <section class="mb-0! min-w-0">
-            <div class="mb-3">
-                <div>
-                    <h2 class="text-[14px]! leading-5! font-semibold! text-black dark:text-fg">
-                        Deployments
-                    </h2>
-                    <p class="mt-0.5 text-[11px] text-neutral-500 dark:text-fg-faint">
-                        Active and recent deployment activity
-                    </p>
-                </div>
-            </div>
+            <x-section-heading title="Deployments" subtitle="Active and recent deployment activity" />
 
             <div class="flex min-w-0 flex-col gap-4">
                 @if ($hasActiveDeployments)
                     <div
-                        class="overflow-hidden rounded-xl border border-neutral-200 bg-white shadow-sm dark:border-white/[0.08] dark:bg-white/[0.025]">
+                        class="overflow-hidden rounded-xl border border-neutral-200 bg-white shadow-sm dark:border-white/[0.08] dark:bg-white/[0.05]">
                         <div class="border-b border-neutral-200 px-4 py-2.5 dark:border-white/[0.08]">
                             <h3 class="text-[12px]! leading-4! font-semibold! text-black dark:text-fg">
                                 Active
@@ -52,7 +43,7 @@
                         </div>
 
                         <div
-                            class="dashboard-deployment-table-grid hidden items-center gap-4 border-b border-neutral-200 bg-neutral-50 px-4 py-2.5 text-[11px] font-medium text-neutral-500 md:grid dark:border-white/[0.08] dark:bg-white/[0.025] dark:text-fg-faint">
+                            class="dashboard-deployment-table-grid hidden items-center gap-4 border-b border-neutral-200 bg-neutral-50 px-4 py-2.5 text-[11px] font-medium text-neutral-500 md:grid dark:border-white/[0.08] dark:bg-white/[0.05] dark:text-fg-faint">
                             <span>Application</span>
                             <span>Environment</span>
                             <span>Server</span>
@@ -110,7 +101,7 @@
 
                 @if ($hasRecentDeployments)
                     <div
-                        class="overflow-hidden rounded-xl border border-neutral-200 bg-white shadow-sm dark:border-white/[0.08] dark:bg-white/[0.025]">
+                        class="overflow-hidden rounded-xl border border-neutral-200 bg-white shadow-sm dark:border-white/[0.08] dark:bg-white/[0.05]">
                         <div class="border-b border-neutral-200 px-4 py-2.5 dark:border-white/[0.08]">
                             <h3 class="text-[12px]! leading-4! font-semibold! text-black dark:text-fg">
                                 Recent
@@ -121,7 +112,7 @@
                         </div>
 
                         <div
-                            class="dashboard-deployment-table-grid hidden items-center gap-4 border-b border-neutral-200 bg-neutral-50 px-4 py-2.5 text-[11px] font-medium text-neutral-500 md:grid dark:border-white/[0.08] dark:bg-white/[0.025] dark:text-fg-faint">
+                            class="dashboard-deployment-table-grid hidden items-center gap-4 border-b border-neutral-200 bg-neutral-50 px-4 py-2.5 text-[11px] font-medium text-neutral-500 md:grid dark:border-white/[0.08] dark:bg-white/[0.05] dark:text-fg-faint">
                             <span>Application</span>
                             <span>Environment</span>
                             <span>Server</span>
diff --git a/resources/views/livewire/deployments-indicator.blade.php b/resources/views/livewire/deployments-indicator.blade.php
index 5b9e41f76f..7d21ea51c6 100644
--- a/resources/views/livewire/deployments-indicator.blade.php
+++ b/resources/views/livewire/deployments-indicator.blade.php
@@ -11,8 +11,7 @@
                 x-transition:enter-start="translate-y-2" x-transition:enter-end="translate-y-0"
                 x-transition:leave="transition ease-in duration-150" x-transition:leave-start="translate-y-0"
                 x-transition:leave-end="translate-y-2" x-cloak
-                class="absolute bottom-full mb-2 w-[min(22rem,calc(100vw-2rem))] overflow-hidden rounded-xl"
-                style="background: var(--coollabs-elevated); box-shadow: 0 0 0 1px var(--coollabs-line), var(--shadow-modal);">
+                class="surface-popover absolute bottom-full mb-2 w-[min(22rem,calc(100vw-2rem))] overflow-hidden rounded-xl">
                 <div class="max-h-96 space-y-1 overflow-y-auto p-2 scrollbar">
                     @foreach ($this->deployments as $deployment)
                         @php
@@ -71,8 +70,7 @@
 
             {{-- Collapsed pill --}}
             <button type="button" @click="expanded = !expanded"
-                class="flex items-center gap-2 rounded-xl border border-neutral-200 bg-white px-3.5 py-2 text-sm font-medium text-neutral-800 transition-colors hover:bg-neutral-50 dark:border-coolgray-300 dark:bg-surface dark:text-fg dark:hover:bg-raised"
-                style="box-shadow: 0 0 0 1px var(--coollabs-hairline), var(--shadow-modal);"
+                class="flex items-center gap-2 rounded-xl border border-neutral-200 bg-white px-3.5 py-2 text-sm font-medium text-neutral-800 shadow-dropdown transition-colors hover:bg-neutral-50 dark:border-coolgray-300 dark:bg-surface dark:text-fg dark:hover:bg-raised"
                 :aria-expanded="expanded.toString()" aria-label="Active deployments">
                 <svg class="loading-indicator size-3.5 shrink-0 animate-spin"
                     xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24" aria-hidden="true">
diff --git a/resources/views/livewire/destination/index.blade.php b/resources/views/livewire/destination/index.blade.php
index cd07c8fd52..c5c97a4d0e 100644
--- a/resources/views/livewire/destination/index.blade.php
+++ b/resources/views/livewire/destination/index.blade.php
@@ -62,7 +62,7 @@
 
         <div x-cloak x-show="viewMode === 'grid'" class="grid grid-cols-1 gap-3 sm:grid-cols-2 lg:grid-cols-4">
             @foreach ($destinations as $destination)
-                <a x-show="matches(@js([$destination->name, $destination->server->name, $destination->getMorphClass() === 'App\\Models\\SwarmDocker' ? 'Docker Swarm' : 'Standalone Docker']))" class="group flex min-h-28 flex-col rounded-xl border border-neutral-200 bg-white p-3 shadow-sm transition-all hover:-translate-y-px hover:border-neutral-300 hover:no-underline hover:shadow-md dark:border-white/[0.08] dark:bg-white/[0.025] dark:hover:border-white/[0.14]"
+                <a x-show="matches(@js([$destination->name, $destination->server->name, $destination->getMorphClass() === 'App\\Models\\SwarmDocker' ? 'Docker Swarm' : 'Standalone Docker']))" class="group flex min-h-28 flex-col rounded-xl border border-neutral-200 bg-white p-3 shadow-sm transition-all hover:-translate-y-px hover:border-neutral-300 hover:no-underline hover:shadow-md dark:border-white/[0.08] dark:bg-white/[0.05] dark:hover:border-white/[0.14]"
                     {{ wireNavigate() }}
                     href="{{ route('destination.show', ['destination_uuid' => data_get($destination, 'uuid')]) }}">
                     <div class="flex items-start gap-3">
@@ -90,8 +90,8 @@
                 </a>
             @endforeach
         </div>
-        <div x-show="viewMode === 'table'" class="overflow-x-auto rounded-xl border border-neutral-200 bg-white shadow-sm dark:border-white/[0.08] dark:bg-white/[0.025]">
-            <div class="grid min-w-[620px] grid-cols-[minmax(0,1fr)_minmax(10rem,.7fr)_10rem] border-b border-neutral-200 bg-neutral-50 px-4 py-2.5 text-[11px] font-medium text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.025] dark:text-fg-faint">
+        <div x-show="viewMode === 'table'" class="overflow-x-auto rounded-xl border border-neutral-200 bg-white shadow-sm dark:border-white/[0.08] dark:bg-white/[0.05]">
+            <div class="grid min-w-[620px] grid-cols-[minmax(0,1fr)_minmax(10rem,.7fr)_10rem] border-b border-neutral-200 bg-neutral-50 px-4 py-2.5 text-[11px] font-medium text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.05] dark:text-fg-faint">
                 <div>Destination</div><div>Server</div><div>Type</div>
             </div>
             @foreach ($destinations as $destination)
diff --git a/resources/views/livewire/destination/resources.blade.php b/resources/views/livewire/destination/resources.blade.php
index cd89275833..9a279c47ad 100644
--- a/resources/views/livewire/destination/resources.blade.php
+++ b/resources/views/livewire/destination/resources.blade.php
@@ -31,7 +31,7 @@
 
                             <div class="overflow-x-auto">
                                 <div
-                                    class="grid min-w-[680px] grid-cols-[minmax(10rem,.8fr)_minmax(10rem,.8fr)_minmax(12rem,1fr)_8rem] border-b border-neutral-200 bg-neutral-50 px-4 py-2.5 text-[11px] font-medium text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.025] dark:text-fg-faint">
+                                    class="grid min-w-[680px] grid-cols-[minmax(10rem,.8fr)_minmax(10rem,.8fr)_minmax(12rem,1fr)_8rem] border-b border-neutral-200 bg-neutral-50 px-4 py-2.5 text-[11px] font-medium text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.05] dark:text-fg-faint">
                                     <div>Project</div>
                                     <div>Environment</div>
                                     <div>Resource</div>
diff --git a/resources/views/livewire/destination/show.blade.php b/resources/views/livewire/destination/show.blade.php
index cad07fb420..0a7c5a68cf 100644
--- a/resources/views/livewire/destination/show.blade.php
+++ b/resources/views/livewire/destination/show.blade.php
@@ -47,7 +47,7 @@
                                             step2ButtonText="Permanently Delete" canGate="delete"
                                             :canResource="$destination" />
                                     @else
-                                        <x-forms.button disabled tooltip="The default Coolify destination cannot be deleted.">
+                                        <x-forms.button isError disabled tooltip="The default Coolify destination cannot be deleted.">
                                             Delete destination
                                         </x-forms.button>
                                     @endif
diff --git a/resources/views/livewire/global-search.blade.php b/resources/views/livewire/global-search.blade.php
index 9e714b59f9..a05ca431a2 100644
--- a/resources/views/livewire/global-search.blade.php
+++ b/resources/views/livewire/global-search.blade.php
@@ -751,7 +751,7 @@
                         x-transition:leave-start="opacity-100 translate-y-0 sm:scale-100"
                         x-transition:leave-end="opacity-0 -translate-y-2 sm:scale-95"
                         class="{{ $createModalShell }}"
-                        style="box-shadow: 0 0 0 1px var(--coollabs-hairline), var(--shadow-modal)">
+                        style="box-shadow: 0 0 0 1px var(--coollabs-hairline), var(--shadow-dropdown)">
                         <header class="flex-nowrap!">
                             <h3 class="min-w-0 flex-1 truncate">New project</h3>
                             <button type="button" @click="modalOpen=false" class="{{ $createModalClose }}">
@@ -794,7 +794,7 @@
                         x-transition:leave-start="opacity-100 translate-y-0 sm:scale-100"
                         x-transition:leave-end="opacity-0 -translate-y-2 sm:scale-95"
                         class="{{ $createModalShell }}"
-                        style="box-shadow: 0 0 0 1px var(--coollabs-hairline), var(--shadow-modal)">
+                        style="box-shadow: 0 0 0 1px var(--coollabs-hairline), var(--shadow-dropdown)">
                         <header class="flex-nowrap!">
                             <h3 class="min-w-0 flex-1 truncate">New team</h3>
                             <button type="button" @click="modalOpen=false" class="{{ $createModalClose }}">
@@ -837,7 +837,7 @@
                         x-transition:leave-start="opacity-100 translate-y-0 sm:scale-100"
                         x-transition:leave-end="opacity-0 -translate-y-2 sm:scale-95"
                         class="{{ $createModalShell }}"
-                        style="box-shadow: 0 0 0 1px var(--coollabs-hairline), var(--shadow-modal)">
+                        style="box-shadow: 0 0 0 1px var(--coollabs-hairline), var(--shadow-dropdown)">
                         <header class="flex-nowrap!">
                             <h3 class="min-w-0 flex-1 truncate">New S3 storage</h3>
                             <button type="button" @click="modalOpen=false" class="{{ $createModalClose }}">
@@ -880,7 +880,7 @@
                         x-transition:leave-start="opacity-100 translate-y-0 sm:scale-100"
                         x-transition:leave-end="opacity-0 -translate-y-2 sm:scale-95"
                         class="{{ $createModalShell }}"
-                        style="box-shadow: 0 0 0 1px var(--coollabs-hairline), var(--shadow-modal)">
+                        style="box-shadow: 0 0 0 1px var(--coollabs-hairline), var(--shadow-dropdown)">
                         <header class="flex-nowrap!">
                             <h3 class="min-w-0 flex-1 truncate">New private key</h3>
                             <button type="button" @click="modalOpen=false" class="{{ $createModalClose }}">
@@ -923,7 +923,7 @@
                         x-transition:leave-start="opacity-100 translate-y-0 sm:scale-100"
                         x-transition:leave-end="opacity-0 -translate-y-2 sm:scale-95"
                         class="{{ $createModalShell }}"
-                        style="box-shadow: 0 0 0 1px var(--coollabs-hairline), var(--shadow-modal)">
+                        style="box-shadow: 0 0 0 1px var(--coollabs-hairline), var(--shadow-dropdown)">
                         <header class="flex-nowrap!">
                             <h3 class="min-w-0 flex-1 truncate">New GitHub app</h3>
                             <button type="button" @click="modalOpen=false" class="{{ $createModalClose }}">
diff --git a/resources/views/livewire/layout-popups.blade.php b/resources/views/livewire/layout-popups.blade.php
index 693c332d95..938b08f4cc 100644
--- a/resources/views/livewire/layout-popups.blade.php
+++ b/resources/views/livewire/layout-popups.blade.php
@@ -212,17 +212,11 @@
         </x-banner>
     @endif
     @if (request()->query->get('success'))
-        <x-banner>
-            <div class="flex items-center gap-2">
-                <svg class="w-5 h-5 text-green-500 shrink-0" fill="currentColor" viewBox="0 0 20 20">
-                    <path fill-rule="evenodd"
-                        d="M10 18a8 8 0 100-16 8 8 0 000 16zm3.707-9.293a1 1 0 00-1.414-1.414L9 10.586 7.707 9.293a1 1 0 00-1.414 1.414l2 2a1 1 0 001.414 0l4-4z"
-                        clip-rule="evenodd" />
-                </svg>
-                <span><span class="font-bold text-green-500">Welcome onboard!</span> Your subscription has been
-                    activated. It could take a few seconds before it's fully active.</span>
-            </div>
-        </x-banner>
+        <span x-init="$nextTick(() => window.toast('Welcome onboard!', {
+            type: 'success',
+            description: 'Your subscription has been activated. It could take a few seconds before it is fully active.',
+            persistent: true,
+        }))"></span>
     @endif
     @if (currentTeam()->subscriptionPastOverDue())
         <x-banner :closable=false>
diff --git a/resources/views/livewire/profile/appearance.blade.php b/resources/views/livewire/profile/appearance.blade.php
index 19b06438a9..ef29f72653 100644
--- a/resources/views/livewire/profile/appearance.blade.php
+++ b/resources/views/livewire/profile/appearance.blade.php
@@ -1,156 +1,4 @@
 <div>
     <x-slot:title>Appearance | Coolify</x-slot>
-    <div x-data="{
-        theme: localStorage.getItem('theme') === 'purple' ? 'custom' : (localStorage.getItem('theme') || 'dark'),
-        themeColor: localStorage.getItem('themeColor') || '#6b16ed',
-        pageWidth: localStorage.getItem('pageWidth') || 'full',
-        themeColorFrame: null,
-        init() {
-            localStorage.setItem('theme', this.theme);
-            this.applyTheme();
-        },
-        setTheme(type) {
-            this.theme = type;
-            localStorage.setItem('theme', type);
-            this.applyTheme();
-        },
-        setWidth(width) {
-            this.pageWidth = width;
-            localStorage.setItem('pageWidth', width);
-            window.dispatchEvent(new CustomEvent('page-width-changed', { detail: width }));
-        },
-        previewThemeColor(color) {
-            this.themeColor = color;
-
-            if (this.theme !== 'custom') {
-                this.theme = 'custom';
-                document.documentElement.classList.add('dark');
-                document.documentElement.dataset.theme = 'custom';
-            }
-
-            if (this.themeColorFrame) {
-                return;
-            }
-
-            this.themeColorFrame = requestAnimationFrame(() => {
-                document.documentElement.style.setProperty('--theme-base-color', this.themeColor);
-                document.documentElement.style.setProperty('--theme-accent-foreground', window.themeAccentForeground(this.themeColor));
-                this.themeColorFrame = null;
-            });
-        },
-        saveThemeColor(color) {
-            this.previewThemeColor(color);
-            localStorage.setItem('themeColor', color);
-            localStorage.setItem('theme', 'custom');
-        },
-        applyTheme() {
-            const prefersDark = window.matchMedia('(prefers-color-scheme: dark)').matches;
-            const isDark = this.theme === 'dark' || this.theme === 'custom' || (this.theme === 'system' && prefersDark);
-            document.documentElement.classList.toggle('dark', isDark);
-            document.documentElement.dataset.theme = this.theme === 'custom' ? 'custom' : (isDark ? 'dark' : 'light');
-            document.documentElement.style.setProperty('--theme-base-color', this.themeColor);
-            document.documentElement.style.setProperty('--theme-accent-foreground', window.themeAccentForeground(this.themeColor));
-            document.querySelector('meta[name=theme-color]')?.setAttribute('content', isDark ? '#101010' : '#ffffff');
-        },
-    }" class="mt-8 flex w-full max-w-none flex-col gap-6 lg:mt-3">
-        <section class="application-settings-section">
-            <div class="application-settings-section-header">
-                <div>
-                    <h2>Color theme</h2>
-                    <p>Choose the color scheme used in this browser.</p>
-                </div>
-            </div>
-            <div class="application-settings-section-body grid gap-3 sm:grid-cols-2 lg:grid-cols-4">
-                @foreach ([
-                    ['value' => 'light', 'label' => 'Light', 'description' => 'Bright surfaces and dark text.', 'preview' => 'bg-white'],
-                    ['value' => 'system', 'label' => 'System', 'description' => 'Follow your operating system.', 'preview' => 'bg-gradient-to-r from-white via-neutral-400 to-[#050505]'],
-                    ['value' => 'dark', 'label' => 'Dark', 'description' => 'Dark surfaces and soft contrast.', 'preview' => 'bg-[#181818]'],
-                    ['value' => 'custom', 'label' => 'Custom', 'description' => 'Choose any color for dark surfaces.', 'preview' => ''],
-                ] as $option)
-                    <div role="button" tabindex="0"
-                        @if ($option['value'] !== 'custom')
-                            @click="setTheme('{{ $option['value'] }}')"
-                            @keydown.enter.prevent="setTheme('{{ $option['value'] }}')"
-                        @endif
-                        class="group relative overflow-hidden rounded-[10px] border border-neutral-200 bg-white text-left transition-[border-color,box-shadow] hover:border-neutral-300 hover:shadow-sm dark:border-white/[0.07] dark:bg-white/[0.025] dark:hover:border-white/[0.12]"
-                        :class="theme === '{{ $option['value'] }}'
-                            ? 'ring-1 ring-coollabs/30 border-coollabs/40 dark:ring-warning/30 dark:border-warning/40'
-                            : ''">
-                        <div class="h-20 {{ $option['preview'] }} border-b border-neutral-200 dark:border-white/[0.07]"
-                            @if ($option['value'] === 'custom') :style="`background: color-mix(in oklab, ${themeColor} 28%, #101011)`" @endif>
-                            <div class="flex h-full items-center justify-center">
-                                @if ($option['value'] === 'custom')
-                                    <div class="h-10 w-20 rounded-md border border-white/15 p-1 shadow-sm">
-                                        <div class="h-full w-full rounded-sm" :style="`background: ${themeColor}`"></div>
-                                    </div>
-                                @else
-                                    <div
-                                    class="h-8 w-20 rounded-md border border-black/10 bg-neutral-100/80 shadow-sm dark:border-white/10 dark:bg-black/20">
-                                    </div>
-                                @endif
-                            </div>
-                        </div>
-                        <div class="p-3">
-                            <div class="flex items-center justify-between gap-2">
-                                <span class="text-sm font-semibold text-black dark:text-fg">
-                                    {{ $option['label'] }}
-                                </span>
-                                <x-reicon name="check-circle" class="size-4 text-coollabs dark:text-warning"
-                                    x-show="theme === '{{ $option['value'] }}'" x-cloak />
-                            </div>
-                            <p class="mt-1 text-xs leading-5 text-neutral-500 dark:text-fg-dim">
-                                {{ $option['description'] }}
-                            </p>
-                        </div>
-                        @if ($option['value'] === 'custom')
-                            <input type="color" :value="themeColor" @input="previewThemeColor($event.target.value)"
-                                @change="saveThemeColor($event.target.value)"
-                                aria-label="Custom theme color"
-                                class="absolute inset-0 z-10 h-full w-full cursor-pointer opacity-0" />
-                        @endif
-                    </div>
-                @endforeach
-            </div>
-        </section>
-
-        <section class="application-settings-section">
-            <div class="application-settings-section-header">
-                <div>
-                    <h2>Page width</h2>
-                    <p>Choose how content uses the available browser width.</p>
-                </div>
-            </div>
-            <div class="application-settings-section-body grid gap-3 sm:grid-cols-2">
-                @foreach ([
-                    ['value' => 'full', 'label' => 'Full width', 'description' => 'Use all available space for page content.'],
-                    ['value' => 'centered', 'label' => 'Centered', 'description' => 'Keep content centered at a comfortable maximum width.'],
-                ] as $option)
-                    <button type="button" @click="setWidth('{{ $option['value'] }}')"
-                        class="group overflow-hidden rounded-[10px] border border-neutral-200 bg-white text-left transition-[border-color,box-shadow] hover:border-neutral-300 hover:shadow-sm dark:border-white/[0.07] dark:bg-white/[0.025] dark:hover:border-white/[0.12]"
-                        :class="pageWidth === '{{ $option['value'] }}'
-                            ? 'ring-1 ring-coollabs/30 border-coollabs/40 dark:ring-warning/30 dark:border-warning/40'
-                            : ''">
-                        <div class="flex h-20 items-center border-b border-neutral-200 bg-neutral-50 px-4 dark:border-white/[0.07] dark:bg-black/15">
-                            <div class="flex h-11 w-full gap-1.5 rounded-md border border-neutral-300 bg-white p-1.5 dark:border-white/15 dark:bg-[#181818]">
-                                <div class="w-3 shrink-0 rounded-sm bg-neutral-200 dark:bg-white/10"></div>
-                                <div @class([
-                                    'h-full rounded-sm bg-neutral-200 dark:bg-white/10',
-                                    'w-full' => $option['value'] === 'full',
-                                    'mx-auto w-2/3' => $option['value'] === 'centered',
-                                ])></div>
-                            </div>
-                        </div>
-                        <div class="p-3">
-                            <div class="flex items-center justify-between gap-2">
-                                <span class="text-sm font-semibold text-black dark:text-fg">{{ $option['label'] }}</span>
-                                <x-reicon name="check-circle" class="size-4 text-coollabs dark:text-warning"
-                                    x-show="pageWidth === '{{ $option['value'] }}'" x-cloak />
-                            </div>
-                            <p class="mt-1 text-xs leading-5 text-neutral-500 dark:text-fg-dim">{{ $option['description'] }}</p>
-                        </div>
-                    </button>
-                @endforeach
-            </div>
-        </section>
-    </div>
+    <x-theme-controls variant="full" />
 </div>
diff --git a/resources/views/livewire/profile/index.blade.php b/resources/views/livewire/profile/index.blade.php
index 4e6b777093..95a1dc5669 100644
--- a/resources/views/livewire/profile/index.blade.php
+++ b/resources/views/livewire/profile/index.blade.php
@@ -275,7 +275,7 @@
                         @if (session('status') === 'two-factor-authentication-confirmed'
                                 || session('status') === 'recovery-codes-generated')
                             <div
-                                class="grid gap-2 rounded-lg border border-neutral-200 bg-neutral-50 p-4 font-mono text-xs text-neutral-700 sm:grid-cols-2 dark:border-white/[0.07] dark:bg-white/[0.025] dark:text-fg-dim">
+                                class="grid gap-2 rounded-lg border border-neutral-200 bg-neutral-50 p-4 font-mono text-xs text-neutral-700 sm:grid-cols-2 dark:border-white/[0.07] dark:bg-white/[0.05] dark:text-fg-dim">
                                 @foreach (request()->user()->recoveryCodes() as $code)
                                     <div>{{ $code }}</div>
                                 @endforeach
diff --git a/resources/views/livewire/project/add-empty.blade.php b/resources/views/livewire/project/add-empty.blade.php
index 06d3e3edfa..72898309b9 100644
--- a/resources/views/livewire/project/add-empty.blade.php
+++ b/resources/views/livewire/project/add-empty.blade.php
@@ -5,7 +5,7 @@
     </div>
 
     <p
-        class="rounded-lg border border-neutral-200 bg-neutral-50 px-3 py-2.5 text-[12px] text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.025] dark:text-fg-dim">
+        class="rounded-lg border border-neutral-200 bg-neutral-50 px-3 py-2.5 text-[12px] text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.05] dark:text-fg-dim">
         A production environment will be created automatically.
     </p>
 
diff --git a/resources/views/livewire/project/application/advanced.blade.php b/resources/views/livewire/project/application/advanced.blade.php
index 429689ce7b..c6113808c5 100644
--- a/resources/views/livewire/project/application/advanced.blade.php
+++ b/resources/views/livewire/project/application/advanced.blade.php
@@ -55,7 +55,7 @@
 
         @if ($application->git_based())
             <x-application.settings-section id="advanced-deployment-section" title="Deployment"
-                helper="Automatic deployments and pull request previews.">
+                helper="Automatic deployments from Git webhooks.">
                 <div class="grid w-full gap-4 sm:grid-cols-2">
                     <x-forms.listbox id="isAutoDeployEnabled" label="Auto deploy" onChange="instantSave"
                         helper="Automatically deploy new commits based on Git webhooks."
@@ -63,18 +63,6 @@
                             ['value' => true, 'label' => 'Deploy on push (webhooks)'],
                             ['value' => false, 'label' => 'Manual deployments only'],
                         ]" :disabled="! $canUpdate" />
-                    <x-forms.listbox id="isPreviewDeploymentsEnabled" label="Preview deployments" onChange="instantSave"
-                        helper="Automatically deploy Preview Deployments for all opened PRs.<br><br>Closing a PR deletes its Preview Deployment."
-                        :options="[
-                            ['value' => false, 'label' => 'Disabled'],
-                            ['value' => true, 'label' => 'Deploy opened pull requests'],
-                        ]" :disabled="! $canUpdate" />
-                    <x-forms.listbox id="isPrDeploymentsPublicEnabled" label="PR deployment access" onChange="instantSave"
-                        helper="When public, anyone can trigger PR deployments. Otherwise fork PRs are blocked and only repository owners, members, and collaborators can trigger them."
-                        :options="[
-                            ['value' => false, 'label' => 'Repository members only'],
-                            ['value' => true, 'label' => 'Public (fork PRs allowed)'],
-                        ]" :disabled="! $canUpdate || ! $isPreviewDeploymentsEnabled" />
                 </div>
             </x-application.settings-section>
 
diff --git a/resources/views/livewire/project/application/configuration.blade.php b/resources/views/livewire/project/application/configuration.blade.php
index 41127287c4..0dda0d4aea 100644
--- a/resources/views/livewire/project/application/configuration.blade.php
+++ b/resources/views/livewire/project/application/configuration.blade.php
@@ -5,7 +5,7 @@
     <livewire:project.shared.configuration-checker :resource="$application" />
     <livewire:project.application.heading :application="$application" :wire:key="'application-heading-'.$currentRoute" />
 
-    <section class="application-settings-workspace mt-4 w-full max-w-none lg:mt-0">
+    <section class="application-settings-workspace w-full max-w-none">
         <div class="grid min-w-0 gap-8 xl:grid-cols-[210px_minmax(0,1fr)] xl:gap-8">
             <x-application.configuration-sidebar :application="$application" :current-route="$currentRoute" />
 
diff --git a/resources/views/livewire/project/application/deployment/show.blade.php b/resources/views/livewire/project/application/deployment/show.blade.php
index 18e0a6cb3f..a10e0b6640 100644
--- a/resources/views/livewire/project/application/deployment/show.blade.php
+++ b/resources/views/livewire/project/application/deployment/show.blade.php
@@ -6,7 +6,7 @@
         <livewire:project.application.heading :application="$application" wire:key="application-heading-deployment-show" />
         <section class="application-settings-workspace mt-4 flex min-h-0 w-full max-w-none flex-1 lg:mt-0">
             <div class="grid min-h-0 min-w-0 flex-1 gap-8 xl:grid-cols-[210px_minmax(0,1fr)] xl:gap-8">
-                <x-application.configuration-sidebar :application="$application" :flush="true"
+                <x-application.configuration-sidebar :application="$application"
                     current-route="project.application.deployment.show" />
                 <div class="flex min-h-0 min-w-0 flex-col gap-4 xl:h-full xl:pt-px">
                     <livewire:project.application.deployment.index :embedded="true"
@@ -367,7 +367,7 @@
                                         x-transition:leave="transition ease-in duration-75"
                                         x-transition:leave-start="transform opacity-100 scale-100"
                                         x-transition:leave-end="transform opacity-0 scale-95"
-                                        class="absolute right-0 z-50 mt-2 w-max origin-top-right rounded-lg border border-neutral-200 bg-white p-1 shadow-modal focus:outline-none dark:border-white/[0.1] dark:bg-[#181818]">
+                                        class="absolute right-0 z-50 mt-2 w-max origin-top-right rounded-lg border border-neutral-200 bg-white p-1 shadow-dropdown focus:outline-none dark:border-white/[0.1] dark:bg-[#181818]">
                                         <div>
                                             <button x-on:click="downloadLogs(); downloadMenuOpen = false"
                                                 class="listbox-option text-neutral-700! hover:bg-neutral-100! dark:text-neutral-200! dark:hover:bg-white/[0.07]!">
diff --git a/resources/views/livewire/project/application/domains.blade.php b/resources/views/livewire/project/application/domains.blade.php
index b80085b9d5..93edafde59 100644
--- a/resources/views/livewire/project/application/domains.blade.php
+++ b/resources/views/livewire/project/application/domains.blade.php
@@ -6,26 +6,31 @@
     $composeDomainGroups = collect($domainRows)
         ->groupBy(fn ($row) => $row['service'] ?? '__unknown')
         ->filter(fn ($rows) => $rows->contains(fn ($row) => ! ($row['is_suggested'] ?? false)));
-    $helperText = $isCompose
-        ? 'Manage domains for every service in this Docker Compose application.'
-        : 'Manage domains for this application.';
     $hasHttpsDomains = collect($domainRows)->contains(
         fn ($row) => ! ($row['is_suggested'] ?? false) && str_starts_with(strtolower($row['url']), 'https://')
     );
 @endphp
 
-<div class="flex flex-col gap-4"
+<div id="application-domains-section" class="domains-overview-container flex flex-col gap-4"
     x-data="{
         domainSearch: '',
         modalOpen: @js($showEditDomainModal || $editDomainDnsFailed),
         editingServiceLabel: @js($editingService ?? ''),
+        editingDomainBaseline: null,
+        get hasAddressChanges() {
+            return this.modalOpen && this.editingDomainBaseline !== null
+                && JSON.stringify($wire.editingDomainParts) !== this.editingDomainBaseline
+                && !$wire.showPortWarningModal && !$wire.showDomainConflictModal;
+        },
         openEditDomain() {
+            this.editingDomainBaseline = JSON.stringify($wire.editingDomainParts);
             this.editingServiceLabel = $wire.editingService || '';
             this.modalOpen = true;
-            this.$nextTick(() => document.getElementById('editingDomainLocal')?.focus?.());
+            this.$nextTick(() => document.getElementById('editingDomainParts-host')?.focus?.());
         },
         closeEditDomain() {
             this.modalOpen = false;
+            this.editingDomainBaseline = null;
             this.editingServiceLabel = '';
         },
         matchesDomainSearch(value) {
@@ -40,56 +45,29 @@
     @if ($hasDnsChecksInProgress)
         <div class="hidden" wire:poll.2000ms="pollDnsChecks" aria-hidden="true"></div>
     @endif
-    <x-application.settings-section id="domains-section" title="Domains">
-        @can('update', $application)
-            <x-slot:actions>
-                <x-forms.button wire:click="checkAllDns" wire:loading.attr="disabled" wire:target="checkAllDns,checkDomainDns">
-                    <x-reicon name="refresh" class="size-3.5" />
-                    Recheck DNS
-                </x-forms.button>
-            </x-slot:actions>
-        @endcan
+    @if ($labelsAreWritable)
+        <x-callout type="warning" title="Domains managed via labels" class="mb-4">
+            Container label readonly mode is disabled. Domains must be set in the Labels section on the General page.
+        </x-callout>
+    @endif
 
-        @if ($labelsAreWritable)
-            <x-callout type="warning" title="Domains managed via labels" class="mb-4">
-                Container label readonly mode is disabled. Domains must be set in the Labels section on the General page.
-            </x-callout>
-        @endif
+    @if ($isCompose && count($composeServices) === 0)
+        <x-callout type="info" title="No services">
+            No non-database services found in the Docker Compose file. Domains can only be assigned to application
+            services.
+        </x-callout>
+    @endif
 
-        @if ($isCompose && count($composeServices) === 0)
-            <x-callout type="info" title="No services">
-                No non-database services found in the Docker Compose file. Domains can only be assigned to application
-                services.
-            </x-callout>
-        @endif
-
-        @cannot('update', $application)
-            <x-callout type="danger" title="Insufficient permissions">
-                You don't have permission to manage domains. Contact your team administrator for access.
-            </x-callout>
-        @endcannot
-
-        <p class="text-sm text-neutral-500 dark:text-fg-dim">
-            {{ $helperText }}
-        </p>
-
-        @if ($hasHttpsDomains && ! $labelsAreWritable)
-            <div class="mt-4 max-w-md">
-                <x-forms.listbox canGate="update" :canResource="$application" id="isForceHttpsEnabled" label="Redirect HTTP to HTTPS"
-                    onChange="updateForceHttps"
-                    helper="Disable only when Cloudflare Tunnel or another proxy connects to Coolify over HTTP. Keep enabled when Cloudflare uses Full or Full (Strict) SSL."
-                    :options="[
-                        ['value' => true, 'label' => 'Enabled'],
-                        ['value' => false, 'label' => 'Disabled'],
-                    ]" :disabled="! auth()->user()->can('update', $application)" />
-            </div>
-        @endif
-
-    </x-application.settings-section>
+    @cannot('update', $application)
+        <x-callout type="danger" title="Insufficient permissions">
+            You don't have permission to manage domains. Contact your team administrator for access.
+        </x-callout>
+    @endcannot
 
     {{-- Toolbar --}}
-    <div class="mt-2 flex flex-wrap items-center gap-2">
+    <div class="flex flex-wrap items-center gap-2">
         <div class="min-w-0 flex-1">
+            <h2 id="domains-section">Domains</h2>
             <p class="text-[13px] text-neutral-500 dark:text-fg-dim">
                 {{ $configuredCount }} domain{{ $configuredCount === 1 ? '' : 's' }}
                 @if ($suggestedCount > 0)
@@ -98,7 +76,7 @@
             </p>
         </div>
         <div class="ml-auto flex flex-wrap items-center gap-2">
-            @if ($isCompose && $composeDomainGroups->isNotEmpty())
+            @if ($hasRows)
                 <div class="relative w-full sm:w-64">
                     <x-reicon name="search"
                         class="pointer-events-none absolute top-1/2 left-2.5 z-10 size-3.5 -translate-y-1/2 text-neutral-400 dark:text-fg-faint" />
@@ -107,6 +85,10 @@
                 </div>
             @endif
             @can('update', $application)
+                <x-forms.button wire:click="checkAllDns" wire:loading.attr="disabled" wire:target="checkAllDns,checkDomainDns">
+                    <x-reicon name="refresh" class="size-3.5" />
+                    Check all DNS
+                </x-forms.button>
                 <div class="relative shrink-0">
                     @include('livewire.project.shared.cloudflare-autoconfigure')
                 </div>
@@ -118,7 +100,7 @@
                                 <button type="button"
                                     class="button button-highlighted">
                                     <x-reicon name="plus" class="size-3.5" />
-                                    Add
+                                    Add domain
                                 </button>
                             </x-slot:content>
                             <form wire:submit="addDomain" class="application-settings-form flex flex-col gap-4">
@@ -168,20 +150,46 @@
         </div>
     </div>
 
+    @if ($hasHttpsDomains && ! $labelsAreWritable)
+        <div class="flex flex-wrap items-center justify-end gap-2 service-domains-https">
+            <label for="isForceHttpsEnabled-trigger" class="mb-0! text-[12px]!">Redirect HTTP to HTTPS</label>
+            <x-helper helper="Disable only when Cloudflare Tunnel or another proxy connects to Coolify over HTTP. Keep enabled when Cloudflare uses Full or Full (Strict) SSL." />
+            <div class="w-28 shrink-0">
+                <x-forms.listbox canGate="update" :canResource="$application" id="isForceHttpsEnabled"
+                    onChange="updateForceHttps" portal
+                    :options="[
+                        ['value' => true, 'label' => 'Enabled'],
+                        ['value' => false, 'label' => 'Disabled'],
+                    ]" :disabled="! auth()->user()->can('update', $application)" />
+            </div>
+        </div>
+    @endif
+
     {{-- Table / empty --}}
     <div id="domains-table-section"
         class="application-settings-section-body mt-1 scroll-mt-28 {{ $hasRows ? 'is-flush' : '' }} w-full">
+        @if ($hasRows)
+            <div class="data-table-header service-domains-overview-grid">
+                <span>Domain</span>
+                <span>Protocol redirect</span>
+                <span>Domain redirect</span>
+                <span>Internal port</span>
+                <span>Search indexing</span>
+                <span>DNS status</span>
+                <span class="text-right">Actions</span>
+            </div>
+        @endif
         @if ($isCompose && count($composeServices) === 0 && ! $hasRows)
             <x-empty size="sm" title="No services available"
                 description="No non-database services found in the Docker Compose file."
                 icon-name="globe" />
         @elseif ($isCompose && $composeDomainGroups->isEmpty())
             <x-empty size="sm" title="No domains configured"
-                description="Add your first domain with the + Add button above. Choose which service receives it."
+                description="Add your first domain with the Add domain button above. Choose which service receives it."
                 icon-name="globe" />
         @elseif (! $hasRows)
             <x-empty size="sm" title="No domains configured"
-                description="Add your first domain with the + Add button above, or generate one with the server wildcard domain."
+                description="Add your first domain with the Add domain button above, or generate one with the server wildcard domain."
                 icon-name="globe" />
         @elseif ($isCompose)
             @php
@@ -213,36 +221,10 @@
                             <span class="min-w-0 flex-1 truncate text-sm font-medium text-black dark:text-white">
                                 {{ $serviceName }}
                             </span>
-                            <div class="flex shrink-0 items-center gap-2">
-                                <span class="hidden text-xs text-neutral-500 sm:inline dark:text-fg-dim">Direction</span>
-                                @if (auth()->user()?->can('update', $application) && ! $labelsAreWritable)
-                                    <x-forms.listbox id="domain-direction-service-{{ $redirectWireKey }}" :wire="false"
-                                        :value="$serviceRedirects[$redirectWireKey] ?? 'both'" preserveValue
-                                        onChange="updateServiceRedirect" :onChangeArgs="[$serviceName]" portal :options="[
-                                            ['value' => 'both', 'label' => 'Allow www & non-www'],
-                                            ['value' => 'www', 'label' => 'Redirect to www'],
-                                            ['value' => 'non-www', 'label' => 'Redirect to non-www'],
-                                        ]" />
-                                @else
-                                    <span class="text-[13px] text-neutral-500 dark:text-fg-dim">
-                                        {{ match ($serviceRedirects[$redirectWireKey] ?? 'both') {
-                                            'www' => 'Redirect to www',
-                                            'non-www' => 'Redirect to non-www',
-                                            default => 'Allow both',
-                                        } }}
-                                    </span>
-                                @endif
-                            </div>
                         </div>
 
-                        <div wire:key="application-compose-domain-rows-{{ $redirectWireKey }}-{{ md5(serialize($rows->all())) }}"
+                        <div wire:key="application-compose-domain-rows-{{ $redirectWireKey }}"
                             class="data-table w-full">
-                            <div class="data-table-header domains-table-grid-service">
-                                <span>Domain</span>
-                                <span>DNS Check</span>
-                                <span class="whitespace-nowrap">Search engine indexing</span>
-                                <span></span>
-                            </div>
                             @foreach ($rows as $row)
                                 @php
                                     $index = collect($domainRows)->search(
@@ -256,9 +238,7 @@
                                     'row' => $row,
                                     'application' => $application,
                                     'labelsAreWritable' => $labelsAreWritable,
-                                    'isCompose' => false,
-                                    'showDirectionControl' => false,
-                                    'domainGridClass' => 'domains-table-grid-service',
+                                    'isCompose' => true,
                                 ])
                             @endforeach
                         </div>
@@ -273,13 +253,6 @@
             </div>
         @else
             <div class="data-table w-full">
-                <div class="data-table-header domains-table-grid">
-                    <span>Domain</span>
-                    <span>DNS Check</span>
-                    <span class="whitespace-nowrap">Search engine indexing</span>
-                    <span>Direction</span>
-                    <span></span>
-                </div>
                 @foreach ($domainRows as $index => $row)
                     @include('livewire.project.application.partials.domain-row', [
                         'index' => $index,
@@ -290,10 +263,15 @@
                     ])
                 @endforeach
             </div>
+            <div x-cloak x-show="domainSearch.trim() && !hasDomainSearchResults(@js(collect($domainRows)->pluck('url')->values()))"
+                class="px-4 py-8">
+                <x-empty size="sm" title="No domains found"
+                    description="No domain matches your search." icon-name="search" />
+            </div>
         @endif
     </div>
 
-    {{-- Edit domain modal: open/close is Alpine-only; server runs only on Save / Continue. --}}
+    {{-- One dialog for address edits and automatically saved domain settings. --}}
     <div class="relative h-auto w-auto" :class="{ 'z-40': modalOpen }"
         @keydown.window.escape="if (modalOpen) { closeEditDomain() }">
         <template x-teleport="body">
@@ -315,7 +293,7 @@
                         class="application-settings-form application-settings-section relative flex max-h-[calc(100dvh-2rem)] w-full flex-col overflow-hidden lg:w-auto lg:min-w-2xl lg:max-w-4xl"
                         style="box-shadow: 0 0 0 1px var(--coollabs-hairline), var(--shadow-modal)">
                         <header class="flex-nowrap!">
-                            <h3 class="min-w-0 flex-1 truncate">Edit domain</h3>
+                            <h3 class="min-w-0 flex-1 truncate">Domain settings</h3>
                             <button type="button" @click="closeEditDomain()"
                                 class="icon-button shrink-0" aria-label="Close">
                                 <x-reicon name="x" class="size-4" />
@@ -324,6 +302,10 @@
                         <div class="application-settings-section-body relative min-h-0 flex-1 overflow-y-auto"
                             style="-webkit-overflow-scrolling: touch;">
                             <form wire:submit="updateDomain" class="flex flex-col gap-4">
+                                <template x-if="modalOpen">
+                                    <x-unsaved-bar action="updateDomain" dirty="hasAddressChanges"
+                                        targets="updateDomain,confirmUpdateDomainDespiteDns" />
+                                </template>
                                 <div x-show="editingServiceLabel" x-cloak class="w-full">
                                     <div class="mb-1.5 flex h-4 w-full items-center gap-1.5">
                                         <label class="mb-0! flex items-center gap-1 text-sm font-medium leading-4">Service</label>
@@ -344,19 +326,47 @@
                                     </x-callout>
                                 @endif
 
-                                <div class="flex flex-wrap items-center justify-end gap-2 pt-2">
-                                    @if ($editDomainDnsFailed)
-                                        <x-forms.button type="button" isError
-                                            wire:click="confirmUpdateDomainDespiteDns">
-                                            Continue
-                                        </x-forms.button>
-                                    @else
-                                        <x-forms.button type="submit" wire:target="updateDomain" isHighlighted>
-                                            Save
-                                        </x-forms.button>
-                                    @endif
-                                </div>
+                                @if ($editDomainDnsFailed)
+                                    <x-forms.button type="button" isError wire:click="confirmUpdateDomainDespiteDns">Continue</x-forms.button>
+                                @endif
                             </form>
+                            @php
+                                $editingRow = $editingIndex !== null ? ($domainRows[$editingIndex] ?? null) : null;
+                            @endphp
+                            @if ($editingRow && ! $labelsAreWritable)
+                                @can('update', $application)
+                                    @php
+                                        $editingKey = hash('sha256', $editingRow['url'].'|'.($editingRow['service'] ?? ''));
+                                        $editingRedirectKey = $isCompose ? $this->serviceRedirectWireKey($editingRow['service']) : null;
+                                        $editingRedirectProperty = $isCompose ? 'serviceRedirects.'.$editingRedirectKey : 'redirect';
+                                    @endphp
+                                    <div wire:key="editing-application-domain-settings-{{ $editingKey }}"
+                                        class="mt-4 grid grid-cols-1 gap-4 border-t border-neutral-200 pt-4 sm:grid-cols-2 dark:border-white/10">
+                                        <p class="sm:col-span-2 text-[12px] text-neutral-500 dark:text-fg-dim">Indexing and redirect changes save automatically.</p>
+                                        <x-forms.listbox id="application-domain-indexing-{{ $editingKey }}"
+                                            label="Search engine indexing" :wire="false" preserveValue
+                                            :value="$application->isDomainNoindexed($editingRow['url']) ? 'noindex' : 'index'"
+                                            onChange="toggleNoindexDomain" :onChangeArgs="[$editingRow['url']]" portal
+                                            :options="[
+                                                ['value' => 'index', 'label' => 'Indexable'],
+                                                ['value' => 'noindex', 'label' => 'Noindex'],
+                                            ]" />
+                                        <x-forms.listbox id="application-domain-direction-{{ $editingKey }}"
+                                            label="www redirect" :wire="false" preserveValue
+                                            :value="$isCompose ? ($serviceRedirects[$editingRedirectKey] ?? 'both') : $redirect"
+                                            :x-effect="'value = $wire.get('.json_encode($editingRedirectProperty).')'"
+                                            :helper="$isCompose ? 'Applies to all domains for this Compose service.' : 'Applies to all domains for this application.'"
+                                            :onChange="$isCompose ? 'updateServiceRedirect' : 'updateRedirect'"
+                                            :onChangeArgs="$isCompose ? [$editingRow['service']] : []" portal
+                                            :options="[
+                                                ['value' => 'both', 'label' => 'No redirect'],
+                                                ['value' => 'www', 'label' => 'Redirect to www'],
+                                                ['value' => 'non-www', 'label' => 'Redirect to non-www'],
+                                            ]" />
+                                    </div>
+                                @endcan
+                            @endif
+
                         </div>
                     </div>
                 </div>
diff --git a/resources/views/livewire/project/application/general.blade.php b/resources/views/livewire/project/application/general.blade.php
index 6c455c197b..1150b8d998 100644
--- a/resources/views/livewire/project/application/general.blade.php
+++ b/resources/views/livewire/project/application/general.blade.php
@@ -48,7 +48,7 @@
                     $domainCount = countDomains($fqdn);
                 }
             @endphp
-            <div class="flex items-center gap-3 rounded-lg border border-neutral-200 bg-neutral-50/60 px-4 py-3 dark:border-white/[0.07] dark:bg-white/[0.025]">
+            <div class="flex items-center gap-3 rounded-lg border border-neutral-200 bg-neutral-50/60 px-4 py-3 dark:border-white/[0.07] dark:bg-white/[0.05]">
                 <div class="flex min-w-0 flex-1 items-center gap-3">
                     <div class="flex size-9 shrink-0 items-center justify-center rounded-md bg-neutral-200/70 text-neutral-600 dark:bg-white/[0.07] dark:text-fg-dim">
                         <x-reicon name="globe" class="size-4" />
diff --git a/resources/views/livewire/project/application/heading.blade.php b/resources/views/livewire/project/application/heading.blade.php
index 15181987ce..5bac62ed20 100644
--- a/resources/views/livewire/project/application/heading.blade.php
+++ b/resources/views/livewire/project/application/heading.blade.php
@@ -26,12 +26,13 @@
     @endphp
     <div>
         <div class="mb-3 w-full xl:hidden">
-            <div class="flex min-w-0 flex-col items-start gap-2">
-                <h1 class="min-w-0 max-w-full truncate text-[24px]! leading-7! font-semibold! tracking-tight! text-black dark:text-fg">
+            {{-- Identity row: name truncates, status + links stay pinned right. --}}
+            <div class="flex w-full min-w-0 items-center gap-3">
+                <h1 class="min-w-0 flex-1 truncate text-[22px]! leading-7! font-semibold! tracking-tight! text-black dark:text-fg">
                     {{ $application->name }}
                 </h1>
-                <div class="relative flex w-full min-w-0 items-center gap-2">
-                    <x-status-summary :status="$application->status" />
+                <div class="flex shrink-0 items-center gap-2">
+                    <x-status-summary :status="$application->status" align="right" />
                     <x-applications.links :application="$application" compact />
                 </div>
                 <div class="flex w-full flex-wrap gap-1">
diff --git a/resources/views/livewire/project/application/partials/domain-row.blade.php b/resources/views/livewire/project/application/partials/domain-row.blade.php
index cf8970d814..bcacb44dc5 100644
--- a/resources/views/livewire/project/application/partials/domain-row.blade.php
+++ b/resources/views/livewire/project/application/partials/domain-row.blade.php
@@ -7,49 +7,35 @@
         default => 'neutral',
     };
     $dnsLabel = match ($row['dns_status']) {
-        'ok' => 'DNS OK',
+        'ok' => 'DNS matches',
         'failed' => 'DNS mismatch',
         'skipped' => 'DNS skipped',
         'checking' => 'Checking DNS...',
-        'pending' => 'DNS pending',
+        'pending' => 'Not checked',
         default => 'DNS unknown',
     };
-    $gridClass = $domainGridClass ?? (($isCompose ?? false) ? 'domains-table-grid-compose' : 'domains-table-grid');
-    $domainParts = $isSuggested ? null : parse_url($row['url']);
+    $gridClass = 'service-domains-overview-grid';
+    $publicUrl = getFqdnWithoutPort($row['url']);
+    $domainParts = $isSuggested ? null : parse_url($publicUrl);
     $faviconUrl = is_array($domainParts) && isset($domainParts['scheme'], $domainParts['host'])
-        ? $domainParts['scheme'].'://'.$domainParts['host'].(isset($domainParts['port']) ? ':'.$domainParts['port'] : '').'/favicon.ico'
+        ? $domainParts['scheme'].'://'.$domainParts['host'].'/favicon.ico'
         : null;
-    $redirectPairKey = function (string $url): string {
-        $parts = parse_url($url);
-        if (! is_array($parts) || ! isset($parts['host'])) {
-            return $url;
-        }
-
-        $host = preg_replace('/^www\./i', '', $parts['host']);
-
-        return strtolower(($parts['scheme'] ?? '').'://'.$host.':'.($parts['port'] ?? '').($parts['path'] ?? ''));
-    };
-    $pairKey = $redirectPairKey($row['url']);
-    $firstPairRowIndex = collect($domainRows)
-        ->reject(fn ($item) => (bool) ($item['is_suggested'] ?? false))
-        ->filter(fn ($item) => ($item['service'] ?? null) === ($row['service'] ?? null))
-        ->filter(fn ($item) => $redirectPairKey($item['url']) === $pairKey)
-        ->keys()
-        ->first();
-    $showDirection = ($showDirectionControl ?? true) && ! $isSuggested && $firstPairRowIndex === $index;
+    $rowDirection = $isCompose
+        ? ($serviceRedirects[$this->serviceRedirectWireKey($row['service'])] ?? 'both')
+        : $redirect;
+    $isNoindexed = $application->isDomainNoindexed($row['url']);
     $domainKey = hash('sha256', $row['url'].'|'.($row['service'] ?? ''));
 @endphp
 
 <div wire:key="domain-row-{{ md5(($isSuggested ? 's:' : '') . $row['url'] . '|' . ($row['service'] ?? '')) }}"
-    class="env-table-item">
+    x-show="matchesDomainSearch(@js(($row['service'] ?? '').' '.$row['url']))" class="env-table-item">
     <div @class([
         'data-table-row',
         $gridClass,
         'domains-row-suggested' => $isSuggested,
-        'domains-row-without-direction' => ! $showDirection,
     ])>
         <div class="flex min-w-0 flex-col gap-1">
-            <div class="flex min-w-0 flex-wrap items-center gap-2">
+            <div class="flex min-w-0 items-center gap-2">
                 @if ($isSuggested)
                     <span
                         class="min-w-0 text-[13px] text-black sm:truncate dark:text-white"
@@ -69,29 +55,15 @@
                                 class="invisible absolute inset-0 size-4 rounded-sm" />
                         </span>
                     @endif
-                    <a href="{{ getFqdnWithoutPort($row['url']) }}" target="_blank"
-                        class="min-w-0 flex-1 text-[13px] text-black underline decoration-neutral-300 underline-offset-2 hover:decoration-coollabs sm:truncate dark:text-fg dark:decoration-white/20 dark:hover:decoration-warning"
-                        title="{{ $row['url'] }}">
-                        {{ $row['url'] }}
+                    <a href="{{ $publicUrl }}" target="_blank" rel="noopener noreferrer"
+                        class="min-w-0 flex-1 truncate text-[13px] text-black underline decoration-neutral-300 underline-offset-2 hover:decoration-coollabs dark:text-fg dark:decoration-white/20 dark:hover:decoration-warning"
+                        title="{{ $publicUrl }}">
+                        {{ $publicUrl }}
                     </a>
-                    @if (filled($row['internal_port'] ?? null) && (int) $row['internal_port'] > 0)
-                        <span class="table-badge shrink-0"
-                            title="{{ ($row['has_port_override'] ?? false) ? 'Custom internal port for this domain' : 'Inherited from Ports Exposes' }}">
-                            Internal port {{ $row['internal_port'] }}
-                        </span>
-                    @else
-                        <span class="table-badge table-badge-danger shrink-0"
-                            title="Set Ports Exposes or a per-domain internal port so the proxy can route this domain.">
-                            No internal port
-                        </span>
-                    @endif
                 @endif
                 @if ($isSuggested && ! empty($row['suggestion_label']))
                     <span class="table-badge table-badge-warning shrink-0">{{ $row['suggestion_label'] }}</span>
                 @endif
-                @if ($isCompose ?? false)
-                    <span class="domains-service-mobile table-badge shrink-0">{{ $row['service'] ?? '-' }}</span>
-                @endif
             </div>
             @if ($isSuggested && filled($row['dns_message']))
                 <p class="text-[12px] leading-4 text-amber-700 sm:truncate dark:text-amber-400/90"
@@ -101,14 +73,47 @@
             @endif
         </div>
 
-        @if ($isCompose ?? false)
-            <div class="domains-service-desktop min-w-0 truncate text-[13px] text-neutral-500 dark:text-fg-dim"
-                title="{{ $row['service'] ?? '' }}">
-                {{ $row['service'] ?? '-' }}
-            </div>
-        @endif
+        <div class="service-domain-detail" title="Protocol redirect">
+            <span class="service-domain-detail-label">Protocol redirect</span>
+            <span>{{ str_starts_with($row['url'], 'https://') && $isForceHttpsEnabled ? 'HTTP → HTTPS' : 'Disabled' }}</span>
+        </div>
+        <div class="service-domain-detail" title="Domain redirect">
+            <span class="service-domain-detail-label">Domain redirect</span>
+            <span>{{ match ($rowDirection) { 'www' => 'non-www → www', 'non-www' => 'www → non-www', default => 'Disabled' } }}</span>
+        </div>
+        <div class="service-domain-detail"
+            title="{{ ($row['has_port_override'] ?? false) ? 'Custom internal port for this domain' : 'Inherited from the application or Compose service port' }}">
+            <span class="service-domain-detail-label">Internal port</span>
+            @if (filled($row['internal_port'] ?? null))
+                <span aria-label="Internal port {{ $row['internal_port'] }}">{{ $row['internal_port'] }}</span>
+            @else
+                <span role="img" aria-label="No internal port" title="No internal port. Set Ports Exposes or a per-domain internal port so the proxy can route this domain." class="text-red-500 dark:text-red-400">
+                    <x-reicon name="alert-triangle" class="size-4" />
+                </span>
+            @endif
+        </div>
+        <div class="service-domain-detail">
+            <span class="service-domain-detail-label">Search indexing</span>
+            <span role="img" aria-label="{{ $isNoindexed ? 'Search indexing blocked' : 'Search indexing allowed' }}"
+                title="{{ $isNoindexed ? 'Search indexing blocked' : 'Search indexing allowed' }}">
+                <x-reicon :name="$isNoindexed ? 'x' : 'check'" class="size-4" />
+            </span>
+        </div>
 
-        <div class="flex min-w-0 items-center">
+        <div class="service-domain-mobile-summary" aria-label="Domain routing summary">
+            @if (str_starts_with($row['url'], 'https://') && $isForceHttpsEnabled)
+                <span>HTTP → HTTPS</span>
+            @endif
+            @if (in_array($rowDirection, ['www', 'non-www'], true))
+                <span>{{ $rowDirection === 'www' ? 'non-www → www' : 'www → non-www' }}</span>
+            @elseif (! str_starts_with($row['url'], 'https://') || ! $isForceHttpsEnabled)
+                <span>No redirects</span>
+            @endif
+            <span>Port {{ $row['internal_port'] ?? 'missing' }}</span>
+            <span>{{ $isNoindexed ? 'Noindex' : 'Indexable' }}</span>
+        </div>
+
+        <div class="service-domain-dns flex min-w-0 items-center">
             @if ($row['dns_status'] === 'failed')
                 <x-status-badge as="button" @click="$dispatch('open-dns-records-modal')" :status="$dnsLabel" :type="$dnsType"
                     title="View DNS records to fix" class="cursor-pointer hover:bg-neutral-200 dark:hover:bg-white/[0.1]" />
@@ -118,56 +123,7 @@
             @endif
         </div>
 
-        <div class="min-w-0" title="Search engine indexing">
-            @unless ($isSuggested)
-                <span class="domains-mobile-label">Search engine indexing</span>
-            @endunless
-            @if ($isSuggested)
-                <span class="text-[13px] text-neutral-500 dark:text-fg-dim">-</span>
-            @elseif (auth()->user()?->can('update', $application) && ! $labelsAreWritable)
-                <x-forms.listbox id="domain-indexing-{{ $index }}" :wire="false"
-                    preserveValue
-                    :value="$application->isDomainNoindexed($row['url']) ? 'noindex' : 'index'"
-                    onChange="toggleNoindexDomain" :onChangeArgs="[$row['url']]" portal :options="[
-                        ['value' => 'index', 'label' => 'Indexable'],
-                        ['value' => 'noindex', 'label' => 'Noindex'],
-                    ]" />
-            @else
-                <span class="text-[13px] text-neutral-500 dark:text-fg-dim">
-                    {{ $application->isDomainNoindexed($row['url']) ? 'Noindex' : 'Indexable' }}
-                </span>
-            @endif
-        </div>
-
-        @if ($showDirectionControl ?? true)
-        <div class="min-w-0" title="Direction">
-            @php
-                $rowDirection = $domainDirection ?? $redirect;
-                $directionLabel = match ($rowDirection) {
-                    'www' => 'Redirect to www',
-                    'non-www' => 'Redirect to non-www',
-                    default => 'Allow both',
-                };
-            @endphp
-            @if ($showDirection)
-                <span class="domains-mobile-label">Direction</span>
-            @endif
-            @if ($showDirection && auth()->user()?->can('update', $application) && ! $labelsAreWritable)
-                <x-forms.listbox id="domain-direction-{{ $index }}" :wire="false" :value="$rowDirection"
-                    preserveValue
-                    :onChange="$isCompose ? 'updateServiceRedirect' : 'updateRedirect'"
-                    :onChangeArgs="$isCompose ? [$row['service']] : []" portal :options="[
-                        ['value' => 'both', 'label' => 'Allow www & non-www'],
-                        ['value' => 'www', 'label' => 'Redirect to www'],
-                        ['value' => 'non-www', 'label' => 'Redirect to non-www'],
-                    ]" />
-            @elseif ($showDirection)
-                <span class="text-[13px] text-neutral-500 dark:text-fg-dim">{{ $directionLabel }}</span>
-            @endif
-        </div>
-        @endif
-
-        <div class="flex items-center justify-end gap-1">
+        <div class="service-domain-actions flex items-center justify-end gap-1">
             @can('update', $application)
                 <button type="button" wire:click="checkDomainDns({{ $index }})"
                     wire:loading.attr="disabled"
@@ -193,7 +149,7 @@
                     @else
                         <button type="button" wire:click="startEdit({{ $index }})"
                             class="icon-button shrink-0"
-                            title="Edit domain" aria-label="Edit domain">
+                            title="Domain settings" aria-label="Settings for {{ $publicUrl }}">
                             <x-reicon name="settings" class="size-3.5" />
                         </button>
                         <x-modal-confirmation class="!w-auto shrink-0" title="Remove domain?" buttonTitle="Remove"
diff --git a/resources/views/livewire/project/application/preview-domains.blade.php b/resources/views/livewire/project/application/preview-domains.blade.php
index 2a131e43cd..69e18a2e5c 100644
--- a/resources/views/livewire/project/application/preview-domains.blade.php
+++ b/resources/views/livewire/project/application/preview-domains.blade.php
@@ -1,26 +1,48 @@
-<div class="flex flex-col gap-3" x-data="{ editOpen: false }"
-    @open-preview-domain-edit.window="editOpen = true"
-    @close-preview-domain-edit.window="editOpen = false">
+<div class="domains-overview-container flex flex-col gap-3" x-data="{
+        editOpen: false,
+        domainSearch: '',
+        editingDomainBaseline: null,
+        get hasAddressChanges() {
+            return this.editOpen && this.editingDomainBaseline !== null
+                && JSON.stringify($wire.editingDomainParts) !== this.editingDomainBaseline
+                && !$wire.showPortWarningModal;
+        },
+        openEditDomain() {
+            this.editingDomainBaseline = JSON.stringify($wire.editingDomainParts);
+            this.editOpen = true;
+            this.$nextTick(() => this.$refs.editForm.querySelector('input[required]')?.focus());
+        },
+        closeEditDomain() { this.editOpen = false; this.editingDomainBaseline = null; },
+        matchesDomainSearch(value) { return !this.domainSearch.trim() || value.toLowerCase().includes(this.domainSearch.trim().toLowerCase()); },
+    }"
+    @open-preview-domain-edit.window="if ($event.detail.previewId === {{ $preview->id }}) openEditDomain()"
+    @close-preview-domain-edit.window="if ($event.detail.previewId === {{ $preview->id }}) closeEditDomain()"
+    @keydown.escape.window="if (editOpen && !$wire.showPortWarningModal) closeEditDomain()">
     @if (collect($domainRows)->contains(fn ($row) => $row['dns_status'] === 'checking'))
         <div class="hidden" wire:poll.2000ms="pollDnsChecks" aria-hidden="true"></div>
     @endif
     <div class="flex flex-wrap items-center gap-2">
-        <p class="min-w-0 flex-1 text-[13px] text-neutral-500 dark:text-fg-dim">
+        <p class="min-w-0 flex-1 truncate text-[13px] text-neutral-500 dark:text-fg-dim">
             {{ count($domainRows) }} domain{{ count($domainRows) === 1 ? '' : 's' }}
         </p>
+        @if (count($domainRows) > 0)
+            <input type="search" x-model="domainSearch" aria-label="Search preview domains"
+                class="input h-8! w-full sm:w-64!" placeholder="Search services or domains" />
+        @endif
         @can('update', $preview->application)
             @if (count($domainRows) > 0)
                 <x-forms.button wire:click="checkAllDns" wire:loading.attr="disabled" wire:target="checkAllDns,checkDomainDns">
                     <x-reicon name="refresh" class="size-3.5" />
-                    Recheck DNS
+                    Check all DNS
                 </x-forms.button>
             @endif
             <x-modal-input title="Add domain" :closeOutside="false" :wireIgnore="false"
-                canGate="update" :canResource="$preview->application">
+                canGate="update" :canResource="$preview->application"
+                @close-preview-domain-add.window="if ($event.detail.previewId === {{ $preview->id }}) modalOpen = false">
                 <x-slot:content>
                     <button type="button" class="button button-highlighted">
                         <x-reicon name="plus" class="size-3.5" />
-                        Add
+                        Add domain
                     </button>
                 </x-slot:content>
                 <form wire:submit="addDomain" class="application-settings-form flex flex-col gap-4">
@@ -46,113 +68,170 @@
         </div>
     @else
         <div class="application-settings-section-body is-flush overflow-visible">
-            <div class="data-table-header domains-table-grid-service">
+            <div class="data-table-header service-domains-overview-grid">
                 <span>Domain</span>
-                <span>DNS check</span>
-                <span></span>
-                <span></span>
+                <span>Protocol redirect</span>
+                <span>Domain redirect</span>
+                <span>Internal port</span>
+                <span>Search indexing</span>
+                <span>DNS status</span>
+                <span class="text-right">Actions</span>
             </div>
-            @foreach ($domainRows as $index => $row)
-                @php
-                    $dnsType = match ($row['dns_status']) {
-                        'ok' => 'success',
-                        'failed' => 'error',
-                        'skipped' => 'warning',
-                        default => 'neutral',
-                    };
-                    $dnsLabel = match ($row['dns_status']) {
-                        'ok' => 'DNS OK',
-                        'failed' => 'DNS mismatch',
-                        'skipped' => 'DNS skipped',
-                        default => 'DNS pending',
-                    };
-                    $domainKey = hash('sha256', $row['url'].'|'.($row['service'] ?? ''));
-                @endphp
-                <div wire:key="preview-domain-{{ md5(($row['service'] ?? '') . $row['url']) }}" class="env-table-item">
-                    <div class="data-table-row domains-table-grid-service">
-                        <div class="flex min-w-0 flex-col gap-1">
-                            <div class="flex min-w-0 flex-wrap items-center gap-2">
-                                <x-reicon name="globe" class="size-4 shrink-0 text-neutral-400 dark:text-fg-faint" />
-                                <a href="{{ getFqdnWithoutPort($row['url']) }}" target="_blank"
-                                    class="min-w-0 flex-1 text-[13px] text-black underline decoration-neutral-300 underline-offset-2 hover:decoration-coollabs sm:truncate dark:text-fg dark:decoration-white/20 dark:hover:decoration-warning"
-                                    title="{{ $row['url'] }}">{{ $row['url'] }}</a>
-                                @if (filled($row['internal_port'] ?? null) && (int) $row['internal_port'] > 0)
-                                    <span class="table-badge shrink-0"
-                                        title="{{ ($row['has_port_override'] ?? false) ? 'Custom internal port for this domain' : 'Inherited from Ports Exposes' }}">
-                                        Internal port {{ $row['internal_port'] }}
-                                    </span>
+            @foreach (collect($domainRows)->groupBy(fn ($row) => $row['service'] ?? '', preserveKeys: true) as $serviceName => $rows)
+                @if ($isCompose)
+                    <div wire:key="preview-domain-service-{{ md5($serviceName) }}"
+                        x-show="matchesDomainSearch(@js($serviceName.' '.$rows->pluck('url')->implode(' ')))"
+                        class="border-b border-neutral-200 bg-neutral-50 px-4 py-3 text-sm font-medium dark:border-white/10 dark:bg-white/[0.04]">{{ $serviceName }}</div>
+                @endif
+                @foreach ($rows as $index => $row)
+                    @php
+                        $dnsType = match ($row['dns_status']) {
+                            'ok' => 'success',
+                            'failed' => 'error',
+                            'skipped' => 'warning',
+                            default => 'neutral',
+                        };
+                        $dnsLabel = match ($row['dns_status']) {
+                            'ok' => 'DNS matches',
+                            'failed' => 'DNS mismatch',
+                            'skipped' => 'DNS skipped',
+                            'checking' => 'Checking DNS...',
+                            'pending' => 'Not checked',
+                            default => 'DNS unknown',
+                        };
+                        $domainKey = hash('sha256', $row['url'].'|'.($row['service'] ?? ''));
+                    @endphp
+                    <div wire:key="preview-domain-{{ md5(($row['service'] ?? '') . $row['url']) }}" x-show="matchesDomainSearch(@js(($row['service'] ?? '').' '.$row['url']))" class="env-table-item">
+                        <div class="data-table-row service-domains-overview-grid">
+                            <div class="flex min-w-0 flex-col gap-1">
+                                <div class="flex min-w-0 items-center gap-2">
+                                    <x-reicon name="globe" class="size-4 shrink-0 text-neutral-400 dark:text-fg-faint" />
+                                    <a href="{{ getFqdnWithoutPort($row['url']) }}" target="_blank" rel="noopener noreferrer"
+                                        class="min-w-0 flex-1 truncate text-[13px] text-black underline decoration-neutral-300 underline-offset-2 hover:decoration-coollabs sm:truncate dark:text-fg dark:decoration-white/20 dark:hover:decoration-warning"
+                                        title="{{ getFqdnWithoutPort($row['url']) }}">{{ getFqdnWithoutPort($row['url']) }}</a>
+                                </div>
+                            </div>
+                            <div class="service-domain-detail" title="Protocol redirect">
+                                <span class="service-domain-detail-label">Protocol redirect</span>
+                                <span>{{ str_starts_with($row['url'], 'https://') && $preview->application->isForceHttpsEnabled() ? 'HTTP → HTTPS' : 'Disabled' }}</span>
+                            </div>
+                            <div class="service-domain-detail" title="Domain redirect">
+                                <span class="service-domain-detail-label">Domain redirect</span>
+                                <span>{{ match (($row['redirect'] ?? 'both')) { 'www' => 'non-www → www', 'non-www' => 'www → non-www', default => 'Disabled' } }}</span>
+                            </div>
+                            <div class="service-domain-detail"
+                                title="{{ ($row['has_port_override'] ?? false) ? 'Custom internal port for this domain' : 'Inherited from the application or Compose service port' }}">
+                                <span class="service-domain-detail-label">Internal port</span>
+                                @if (filled($row['internal_port'] ?? null))
+                                    <span aria-label="Internal port {{ $row['internal_port'] }}">{{ $row['internal_port'] }}</span>
                                 @else
-                                    <span class="table-badge table-badge-danger shrink-0"
-                                        title="Set Ports Exposes or a per-domain internal port so the proxy can route this domain.">
-                                        No internal port
+                                    <span role="img" aria-label="No internal port" title="No internal port. Set Ports Exposes or a per-domain internal port so the proxy can route this domain." class="text-red-500 dark:text-red-400">
+                                        <x-reicon name="alert-triangle" class="size-4" />
                                     </span>
                                 @endif
-                                @if (filled($row['service']))
-                                    <span class="table-badge shrink-0">{{ $row['service'] }}</span>
-                                @endif
                             </div>
-                        </div>
-                        <div class="flex min-w-0 items-center">
-                            <x-status-badge :status="$dnsLabel" :type="$dnsType" :title="$row['dns_message']" />
-                        </div>
-                        <div class="hidden"></div>
-                        <div class="flex items-center justify-end gap-1">
-                            @can('update', $preview->application)
-                                <button type="button" wire:click="checkDomainDns({{ $index }})"
-                                    wire:loading.attr="disabled"
-                                    wire:target="checkDomainDns({{ $index }}),checkAllDns"
-                                    class="icon-button shrink-0" title="Check DNS" aria-label="Check DNS">
-                                    <x-reicon name="refresh" class="size-3.5" wire:loading.remove.delay
-                                        wire:target="checkDomainDns({{ $index }}),checkAllDns" />
-                                    <x-loading-on-button wire:loading.delay
-                                        wire:target="checkDomainDns({{ $index }}),checkAllDns" />
-                                </button>
-                                <button type="button" wire:click="startEdit({{ $index }})"
-                                    class="icon-button shrink-0" title="Edit domain" aria-label="Edit domain">
-                                    <x-reicon name="settings" class="size-3.5" />
-                                </button>
-                                <x-modal-confirmation class="!w-auto shrink-0" title="Remove domain?"
-                                    buttonTitle="Remove" isErrorButton
-                                    submitAction="removeDomainByKey({{ $domainKey }})"
-                                    :actions="[
-                                        'This domain will be removed from the preview deployment.',
-                                        'Redeploy the preview to apply proxy changes.',
-                                    ]"
-                                    :confirmWithPassword="false" :confirmWithText="false"
-                                    step2ButtonText="Remove domain">
-                                    <x-slot:trigger>
-                                        <button type="button"
-                                            class="icon-button shrink-0 text-red-500 hover:text-red-600 dark:text-red-400 dark:hover:text-red-300"
-                                            title="Remove domain" aria-label="Remove domain">
-                                            <x-reicon name="trash" class="size-3.5" />
-                                        </button>
-                                    </x-slot:trigger>
-                                </x-modal-confirmation>
-                            @endcan
+                            <div class="service-domain-detail">
+                                <span class="service-domain-detail-label">Search indexing</span>
+                                <span role="img" aria-label="Search indexing blocked"
+                                    title="Search indexing blocked">
+                                    <x-reicon name="x" class="size-4" />
+                                </span>
+                            </div>
+
+                            <div class="service-domain-mobile-summary" aria-label="Domain routing summary">
+                                @if (str_starts_with($row['url'], 'https://') && $preview->application->isForceHttpsEnabled())
+                                    <span>HTTP → HTTPS</span>
+                                @endif
+                                @if (in_array($row['redirect'] ?? 'both', ['www', 'non-www'], true))
+                                    <span>{{ ($row['redirect'] ?? 'both') === 'www' ? 'non-www → www' : 'www → non-www' }}</span>
+                                @elseif (! str_starts_with($row['url'], 'https://') || ! $preview->application->isForceHttpsEnabled())
+                                    <span>No redirects</span>
+                                @endif
+                                <span>Port {{ $row['internal_port'] ?? 'missing' }}</span>
+                                <span>Noindex</span>
+                            </div>
+
+                            <div class="service-domain-dns flex min-w-0 items-center">
+                                <x-status-badge :status="$dnsLabel" :type="$dnsType" :title="$row['dns_message']" />
+                            </div>
+                            <div class="service-domain-actions flex items-center justify-end gap-1">
+                                @can('update', $preview->application)
+                                    <button type="button" wire:click="checkDomainDns({{ $index }})"
+                                        wire:loading.attr="disabled"
+                                        wire:target="checkDomainDns({{ $index }}),checkAllDns"
+                                        class="icon-button shrink-0" title="Check DNS" aria-label="Check DNS">
+                                        <x-reicon name="refresh" class="size-3.5" wire:loading.remove.delay
+                                            wire:target="checkDomainDns({{ $index }}),checkAllDns" />
+                                        <x-loading-on-button wire:loading.delay
+                                            wire:target="checkDomainDns({{ $index }}),checkAllDns" />
+                                    </button>
+                                    <button type="button" wire:click="startEdit({{ $index }})"
+                                        class="icon-button shrink-0" title="Domain settings" aria-label="Settings for {{ getFqdnWithoutPort($row['url']) }}">
+                                        <x-reicon name="settings" class="size-3.5" />
+                                    </button>
+                                    <x-modal-confirmation class="!w-auto shrink-0" title="Remove domain?"
+                                        buttonTitle="Remove" isErrorButton
+                                        submitAction="removeDomainByKey({{ $domainKey }})"
+                                        :actions="[
+                                            'This domain will be removed from the preview deployment.',
+                                            'Redeploy the preview to apply proxy changes.',
+                                        ]"
+                                        :confirmWithPassword="false" :confirmWithText="false"
+                                        step2ButtonText="Remove domain">
+                                        <x-slot:trigger>
+                                            <button type="button"
+                                                class="icon-button shrink-0 text-red-500 hover:text-red-600 dark:text-red-400 dark:hover:text-red-300"
+                                                title="Remove domain" aria-label="Remove domain">
+                                                <x-reicon name="trash" class="size-3.5" />
+                                            </button>
+                                        </x-slot:trigger>
+                                    </x-modal-confirmation>
+                                @endcan
+                            </div>
                         </div>
                     </div>
-                </div>
+                @endforeach
             @endforeach
+            <div x-cloak x-show="domainSearch.trim() && !@js(collect($domainRows)->map(fn ($row) => ($row['service'] ?? '').' '.$row['url'])->values()).some(value => matchesDomainSearch(value))" class="px-4 py-8">
+                <x-empty size="sm" title="No domains found" description="No service or domain matches your search." icon-name="search" />
+            </div>
         </div>
     @endif
 
     <template x-teleport="body">
         <div x-show="editOpen" x-cloak class="fixed inset-0 z-99 overflow-y-auto">
-            <div class="absolute inset-0 bg-black/50 backdrop-blur-[2px]" @click="editOpen = false"></div>
+            <div class="absolute inset-0 bg-black/50 backdrop-blur-[2px]" @click="closeEditDomain()"></div>
             <div class="relative flex min-h-full items-center justify-center p-4">
                 <div x-show="editOpen" x-trap.inert.noscroll="editOpen"
-                    class="application-settings-form application-settings-section relative w-full max-w-3xl">
+                    data-preview-domain-dialog class="application-settings-form application-settings-section relative w-full max-w-3xl">
                     <header>
-                        <h3>Edit domain</h3>
-                        <button type="button" @click="editOpen = false" class="icon-button" aria-label="Close">
+                        <h3>Domain settings</h3>
+                        <button type="button" @click="closeEditDomain()" class="icon-button" aria-label="Close">
                             <x-reicon name="x" class="size-4" />
                         </button>
                     </header>
                     <div class="application-settings-section-body">
-                        <form wire:submit="updateDomain" class="flex flex-col gap-4">
+                        <form x-ref="editForm" wire:submit="updateDomain" class="flex flex-col gap-4">
+                            <template x-if="editOpen">
+                                <x-unsaved-bar action="updateDomain" dirty="hasAddressChanges" targets="updateDomain,confirmUseUnknownPort" />
+                            </template>
+                            @if ($editingIndex !== null && filled($domainRows[$editingIndex]['service'] ?? null))
+                                <x-forms.input label="Service" :value="$domainRows[$editingIndex]['service']" readonly />
+                            @endif
                             <x-forms.domain-input id="editingDomainParts" />
-                            <div class="flex justify-end">
-                                <x-forms.button type="submit" isHighlighted>Save</x-forms.button>
+                            <div class="grid grid-cols-1 gap-4 border-t border-neutral-200 pt-4 sm:grid-cols-2 dark:border-white/10">
+                                <x-forms.listbox id="preview-domain-indexing-{{ $preview->id }}" label="Search engine indexing"
+                                    :wire="false" value="noindex" disabled
+                                    helper="Preview deployments are always excluded from search indexing."
+                                    :options="[['value' => 'noindex', 'label' => 'Noindex']]" />
+                                <x-forms.listbox id="preview-domain-direction-{{ $preview->id }}" label="www redirect"
+                                    :wire="false" :value="$editingIndex !== null ? ($domainRows[$editingIndex]['redirect'] ?? 'both') : 'both'" disabled
+                                    helper="Read-only preview routing configuration."
+                                    :options="[
+                                        ['value' => 'both', 'label' => 'No redirect'],
+                                        ['value' => 'www', 'label' => 'Redirect to www'],
+                                        ['value' => 'non-www', 'label' => 'Redirect to non-www'],
+                                    ]" />
                             </div>
                         </form>
                     </div>
diff --git a/resources/views/livewire/project/application/previews.blade.php b/resources/views/livewire/project/application/previews.blade.php
index ac616b84a3..54c8b9dfd3 100644
--- a/resources/views/livewire/project/application/previews.blade.php
+++ b/resources/views/livewire/project/application/previews.blade.php
@@ -1,4 +1,36 @@
 <div class="flex flex-col gap-6">
+    @if ($application->git_based())
+        @php
+            $canUpdate = auth()->user()->can('update', $application);
+        @endphp
+        <x-application.settings-section id="preview-settings-section" title="Preview settings"
+            helper="Automatic pull request deployments and who can trigger them.">
+            <x-slot:actions>
+                @can('update', $application)
+                    @if ($isPreviewDeploymentsEnabled)
+                        <x-forms.button wire:click="togglePreviewDeployments" wire:target="togglePreviewDeployments">
+                            Disable preview deployments
+                        </x-forms.button>
+                    @else
+                        <x-forms.button wire:click="togglePreviewDeployments" wire:target="togglePreviewDeployments"
+                            isHighlighted>
+                            Enable preview deployments
+                        </x-forms.button>
+                    @endif
+                @endcan
+            </x-slot:actions>
+
+            <div class="w-full">
+                <x-forms.listbox id="isPrDeploymentsPublicEnabled" label="PR deployment access" onChange="savePreviewSettings"
+                    helper="When public, anyone can trigger PR deployments. Otherwise fork PRs are blocked and only repository owners, members, and collaborators can trigger them."
+                    :options="[
+                        ['value' => false, 'label' => 'Repository members only'],
+                        ['value' => true, 'label' => 'Public (fork PRs allowed)'],
+                    ]" :disabled="! $canUpdate || ! $isPreviewDeploymentsEnabled" />
+            </div>
+        </x-application.settings-section>
+    @endif
+
     <livewire:project.application.preview.form :application="$application" />
 
     @if (count($application->additional_servers) > 0)
diff --git a/resources/views/livewire/project/application/source.blade.php b/resources/views/livewire/project/application/source.blade.php
index b855e337be..3a964396b1 100644
--- a/resources/views/livewire/project/application/source.blade.php
+++ b/resources/views/livewire/project/application/source.blade.php
@@ -25,7 +25,7 @@
 
             @if (blank($privateKeyId))
                 <div
-                    class="mb-4 flex items-center justify-between gap-3 rounded-lg bg-neutral-50 px-3 py-2.5 ring-1 ring-neutral-200 dark:bg-white/[0.025] dark:ring-white/[0.07]">
+                    class="mb-4 flex items-center justify-between gap-3 rounded-lg bg-neutral-50 px-3 py-2.5 ring-1 ring-neutral-200 dark:bg-white/[0.05] dark:ring-white/[0.07]">
                     <span class="text-[12px] text-neutral-500 dark:text-fg-dim">Connected source</span>
                     <span class="text-[12px] font-medium text-neutral-900 dark:text-fg">
                         {{ data_get($application, 'source.name', 'No source connected') }}
@@ -48,7 +48,7 @@
         <x-application.settings-section title="Deploy key"
             description="The SSH key Coolify uses to clone this private repository.">
             <div
-                class="mb-4 flex items-center justify-between gap-3 rounded-lg bg-neutral-50 px-3 py-2.5 ring-1 ring-neutral-200 dark:bg-white/[0.025] dark:ring-white/[0.07]">
+                class="mb-4 flex items-center justify-between gap-3 rounded-lg bg-neutral-50 px-3 py-2.5 ring-1 ring-neutral-200 dark:bg-white/[0.05] dark:ring-white/[0.07]">
                 <span class="text-[12px] text-neutral-500 dark:text-fg-dim">Attached private key</span>
                 <span class="text-[12px] font-medium text-neutral-900 dark:text-fg">{{ $privateKeyName }}</span>
             </div>
@@ -56,7 +56,7 @@
                 <div class="grid gap-2 sm:grid-cols-2">
                     @forelse ($privateKeys as $key)
                         <button type="button" wire:click="setPrivateKey('{{ $key->id }}')"
-                            class="flex min-h-11 items-center rounded-lg border border-neutral-200 bg-white px-3 text-left text-[12px] font-medium transition-colors hover:bg-neutral-50 dark:border-white/[0.08] dark:bg-white/[0.025] dark:hover:bg-white/[0.05]">
+                            class="flex min-h-11 items-center rounded-lg border border-neutral-200 bg-white px-3 text-left text-[12px] font-medium transition-colors hover:bg-neutral-50 dark:border-white/[0.08] dark:bg-white/[0.05] dark:hover:bg-white/[0.05]">
                             {{ $key->name }}
                         </button>
                     @empty
@@ -129,7 +129,7 @@
                             shortConfirmationLabel="Confirmation text" :confirmWithPassword="false">
                             <x-slot:trigger>
                                 <button type="button"
-                                    class="group flex w-full min-h-16 items-center gap-3 rounded-xl border border-neutral-200 bg-white p-3 text-left shadow-sm transition-all hover:-translate-y-px hover:border-neutral-300 hover:bg-neutral-50 hover:shadow-md focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-accent dark:border-white/[0.08] dark:bg-white/[0.025] dark:hover:border-white/[0.14] dark:hover:bg-white/[0.05]">
+                                    class="group flex w-full min-h-16 items-center gap-3 rounded-xl border border-neutral-200 bg-white p-3 text-left shadow-sm transition-all hover:-translate-y-px hover:border-neutral-300 hover:bg-neutral-50 hover:shadow-md focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-accent dark:border-white/[0.08] dark:bg-white/[0.05] dark:hover:border-white/[0.14] dark:hover:bg-white/[0.05]">
                                     <div
                                         class="flex size-9 shrink-0 items-center justify-center rounded-lg border border-neutral-200 bg-neutral-50 text-neutral-500 transition-colors group-hover:border-neutral-300 group-hover:text-neutral-700 dark:border-white/[0.08] dark:bg-white/[0.04] dark:text-fg-dim dark:group-hover:border-white/[0.12] dark:group-hover:text-fg">
                                         <x-git-icon class="size-4" :git="$sourceMorph" />
diff --git a/resources/views/livewire/project/database/backup-edit/general.blade.php b/resources/views/livewire/project/database/backup-edit/general.blade.php
index caabf249ac..08c64b1171 100644
--- a/resources/views/livewire/project/database/backup-edit/general.blade.php
+++ b/resources/views/livewire/project/database/backup-edit/general.blade.php
@@ -19,9 +19,9 @@
                         Disable backup
                     </x-forms.button>
                 @endif
-                @if (str($status)->startsWith('running'))
-                    <x-forms.button type="button" wire:click="backupNow">Back up now</x-forms.button>
-                @endif
+                <x-forms.button type="button" wire:click="backupNow"
+                    :disabled="! str($status)->startsWith('running')"
+                    :tooltip="! str($status)->startsWith('running') ? 'The database must be running to start a backup.' : null">Back up now</x-forms.button>
             </div>
         </div>
 
@@ -91,6 +91,9 @@
                     required />
                 <x-forms.input label="Timeout" id="timeout" type="number" min="60"
                     helper="Maximum backup runtime in seconds." required />
+                <x-forms.input label="Missing backup alert after" id="missingBackupNotificationDays" type="number"
+                    min="0" max="365" suffix="days" canGate="manageBackups" :canResource="$backup->database"
+                    helper="Notify through backup failure channels after this many days without an execution. Use 0 to disable." required />
             </div>
         </div>
     </section>
diff --git a/resources/views/livewire/project/database/backup-edit/s3.blade.php b/resources/views/livewire/project/database/backup-edit/s3.blade.php
index 180ff0a169..dcfb7c3815 100644
--- a/resources/views/livewire/project/database/backup-edit/s3.blade.php
+++ b/resources/views/livewire/project/database/backup-edit/s3.blade.php
@@ -1,31 +1,21 @@
 @if ($availableS3Storages->isEmpty())
-    <section class="application-settings-section">
-        <div class="application-settings-section-header">
-            <div>
-                <h2>S3 storage</h2>
-                <p>Send backup archives to a validated object storage destination.</p>
-            </div>
-        </div>
-        <div class="application-settings-section-body is-flush">
-            <x-empty title="No validated S3 storage"
-                description="Add and validate an S3 storage destination before enabling remote backups."
-                icon-name="storages">
-                <x-slot:contents>
-                    <a class="button" {{ wireNavigate() }} href="{{ route('storage.index') }}">Open S3 storage</a>
-                </x-slot:contents>
-            </x-empty>
-        </div>
-    </section>
+    <x-application.settings-section title="S3 storage"
+        description="Send backup archives to a validated object storage destination." flush>
+        <x-empty title="No validated S3 storage"
+            description="Add and validate an S3 storage destination before enabling remote backups."
+            icon-name="storages">
+            <x-slot:contents>
+                <a class="button" {{ wireNavigate() }} href="{{ route('storage.index') }}">Open S3 storage</a>
+            </x-slot:contents>
+        </x-empty>
+    </x-application.settings-section>
 @else
     <form wire:submit="submit">
         <x-unsaved-bar action="submit" />
 
-        <section class="application-settings-section">
-            <div class="application-settings-section-header">
-                <div>
-                    <h2>S3 storage</h2>
-                    <p>Choose where remote backups are stored and whether local copies are retained.</p>
-                </div>
+        <x-application.settings-section title="S3 storage"
+            description="Choose where remote backups are stored and whether local copies are retained.">
+            <x-slot:actions>
                 @if (! $saveS3)
                     <x-forms.button type="button" wire:click="toggleS3" wire:loading.attr="disabled"
                         wire:target="toggleS3" isHighlighted>Enable S3</x-forms.button>
@@ -33,19 +23,19 @@
                     <x-forms.button type="button" wire:click="toggleS3" wire:loading.attr="disabled"
                         wire:target="toggleS3">Disable S3</x-forms.button>
                 @endif
-            </div>
-            <div class="application-settings-section-body grid gap-4 sm:grid-cols-2">
-                <x-forms.listbox id="s3StorageId" label="S3 storage" :required="$saveS3"
+            </x-slot:actions>
+            <div class="grid gap-4 sm:grid-cols-2">
+                <x-forms.listbox id="s3StorageId" label="S3 storage" portal :required="$saveS3"
                     :options="$availableS3Storages->map(fn ($s3) => [
                         'value' => $s3->id,
                         'label' => $s3->name,
                     ])->values()->all()" />
-                <x-forms.listbox id="disableLocalBackup" label="Local copy" :disabled="! $saveS3"
+                <x-forms.listbox id="disableLocalBackup" label="Local copy" portal :disabled="! $saveS3"
                     :options="[
                         ['value' => false, 'label' => 'Keep local backup'],
                         ['value' => true, 'label' => 'Delete after S3 upload'],
                     ]" />
             </div>
-        </section>
+        </x-application.settings-section>
     </form>
 @endif
diff --git a/resources/views/livewire/project/database/backup-now.blade.php b/resources/views/livewire/project/database/backup-now.blade.php
index e5b1daf8d8..6e91428573 100644
--- a/resources/views/livewire/project/database/backup-now.blade.php
+++ b/resources/views/livewire/project/database/backup-now.blade.php
@@ -1 +1,3 @@
-<x-forms.button wire:click='backupNow'>Backup Now</x-forms.button>
+<x-forms.button wire:click="backupNow"
+    :disabled="! str($backup->database->status)->startsWith('running')"
+    :tooltip="! str($backup->database->status)->startsWith('running') ? 'The database must be running to start a backup.' : null">Back up now</x-forms.button>
diff --git a/resources/views/livewire/project/database/import-form.blade.php b/resources/views/livewire/project/database/import-form.blade.php
index dd57b121c2..6bb5892dca 100644
--- a/resources/views/livewire/project/database/import-form.blade.php
+++ b/resources/views/livewire/project/database/import-form.blade.php
@@ -105,7 +105,7 @@
                         class="flex min-h-20 items-center gap-3 rounded-[10px] border p-3 text-left transition-colors"
                         :class="restoreType === 'file'
                             ? 'border-coollabs/35 bg-coollabs/[0.06] text-coollabs dark:border-warning/30 dark:bg-warning/[0.08] dark:text-warning'
-                            : 'border-neutral-200 bg-white hover:border-neutral-300 dark:border-white/[0.08] dark:bg-white/[0.025] dark:hover:border-white/[0.14]'">
+                            : 'border-neutral-200 bg-white hover:border-neutral-300 dark:border-white/[0.08] dark:bg-white/[0.05] dark:hover:border-white/[0.14]'">
                         <span
                             class="flex size-9 shrink-0 items-center justify-center rounded-lg bg-neutral-100 dark:bg-white/[0.06]">
                             <x-reicon name="file" class="size-4" />
@@ -122,7 +122,7 @@
                             class="flex min-h-20 items-center gap-3 rounded-[10px] border p-3 text-left transition-colors"
                             :class="restoreType === 's3'
                                 ? 'border-coollabs/35 bg-coollabs/[0.06] text-coollabs dark:border-warning/30 dark:bg-warning/[0.08] dark:text-warning'
-                                : 'border-neutral-200 bg-white hover:border-neutral-300 dark:border-white/[0.08] dark:bg-white/[0.025] dark:hover:border-white/[0.14]'">
+                                : 'border-neutral-200 bg-white hover:border-neutral-300 dark:border-white/[0.08] dark:bg-white/[0.05] dark:hover:border-white/[0.14]'">
                             <span
                                 class="flex size-9 shrink-0 items-center justify-center rounded-lg bg-neutral-100 dark:bg-white/[0.06]">
                                 <x-reicon name="storages" class="size-4" />
@@ -139,7 +139,7 @@
             {{-- File Restore Section --}}
             @can('update', $this->resource)
                 <div x-cloak x-show="restoreType === 'file'"
-                    class="mt-4 rounded-[10px] border border-neutral-200 bg-neutral-50 p-4 dark:border-white/[0.08] dark:bg-white/[0.025]">
+                    class="mt-4 rounded-[10px] border border-neutral-200 bg-neutral-50 p-4 dark:border-white/[0.08] dark:bg-white/[0.05]">
                     <form class="flex flex-col gap-3 sm:flex-row sm:items-end">
                         <div class="min-w-0 flex-1">
                             <x-forms.input label="File path on the server"
@@ -158,7 +158,7 @@
                     </div>
 
                     <form action="{{ route('upload.backup', ['databaseUuid' => $resourceUuid]) }}"
-                        class="dropzone rounded-lg! border! border-dashed! border-neutral-300! bg-white! dark:border-white/[0.12]! dark:bg-white/[0.025]!"
+                        class="dropzone rounded-lg! border! border-dashed! border-neutral-300! bg-white! dark:border-white/[0.12]! dark:bg-white/[0.05]!"
                         id="my-dropzone" wire:ignore>
                         @csrf
                     </form>
@@ -206,7 +206,7 @@
                             ->all();
                     @endphp
                     <div x-cloak x-show="restoreType === 's3'"
-                        class="mt-4 rounded-[10px] border border-neutral-200 bg-neutral-50 p-4 dark:border-white/[0.08] dark:bg-white/[0.025]">
+                        class="mt-4 rounded-[10px] border border-neutral-200 bg-neutral-50 p-4 dark:border-white/[0.08] dark:bg-white/[0.05]">
                         <div class="grid gap-4 sm:grid-cols-2">
                             <x-forms.listbox id="s3StorageId" label="S3 storage" :options="$s3StorageOptions"
                                 placeholder="Select storage" live />
diff --git a/resources/views/livewire/project/database/scheduled-backups.blade.php b/resources/views/livewire/project/database/scheduled-backups.blade.php
index 47a04820e1..e52586eaaf 100644
--- a/resources/views/livewire/project/database/scheduled-backups.blade.php
+++ b/resources/views/livewire/project/database/scheduled-backups.blade.php
@@ -56,7 +56,7 @@
                 description="Create a schedule to start protecting this database."
                 icon-name="storages" />
         @else
-            <div x-cloak x-show="search === '' || hasMatches()" class="data-table overflow-hidden rounded-xl border border-neutral-200 bg-white shadow-sm dark:border-white/[0.08] dark:bg-white/[0.025]">
+            <div x-cloak x-show="search === '' || hasMatches()" class="data-table overflow-hidden rounded-xl border border-neutral-200 bg-white shadow-sm dark:border-white/[0.08] dark:bg-white/[0.05]">
                 <div class="data-table-header scheduled-backups-table-grid">
                     <span>Schedule</span>
                     <span>Latest run</span>
diff --git a/resources/views/livewire/project/index.blade.php b/resources/views/livewire/project/index.blade.php
index 38c8f51c7f..d3554b8828 100644
--- a/resources/views/livewire/project/index.blade.php
+++ b/resources/views/livewire/project/index.blade.php
@@ -103,7 +103,7 @@
                 <div class="grid grid-cols-1 gap-3 sm:grid-cols-2 lg:grid-cols-4">
                     <template x-for="project in paginatedProjects" :key="project.uuid">
                         <article
-                            class="group relative flex min-h-28 flex-col rounded-xl border border-neutral-200 bg-white p-3 shadow-sm transition-all hover:-translate-y-px hover:border-neutral-300 hover:shadow-md dark:border-white/[0.08] dark:bg-white/[0.025] dark:hover:border-white/[0.14]">
+                            class="group relative flex min-h-28 flex-col rounded-xl border border-neutral-200 bg-white p-3 shadow-sm transition-all hover:-translate-y-px hover:border-neutral-300 hover:shadow-md dark:border-white/[0.08] dark:bg-white/[0.05] dark:hover:border-white/[0.14]">
                             <a :href="project.href" {{ wireNavigate() }} class="absolute inset-0 rounded-xl"
                                 :aria-label="`Open ${project.name}`"></a>
                             <div class="flex items-start gap-3">
@@ -151,15 +151,15 @@
                         </article>
                     </template>
                 </div>
-                <x-client-pagination x-show="filteredProjects.length > 0" class="mt-3 rounded-xl border border-neutral-200 bg-white shadow-sm dark:border-white/[0.08] dark:bg-white/[0.025]"
+                <x-client-pagination x-show="filteredProjects.length > 0" class="mt-3 rounded-xl border border-neutral-200 bg-white shadow-sm dark:border-white/[0.08] dark:bg-white/[0.05]"
                     summary="`${rangeStart}-${rangeEnd} of ${filteredProjects.length}`" page-size-model="pageSize"
                     storage-key="coolify.page-size.projects" :options="[12, 24, 48, 96]" />
             </div>
 
             <div x-show="viewMode === 'table'"
-                class="overflow-hidden rounded-xl border border-neutral-200 bg-white shadow-sm dark:border-white/[0.08] dark:bg-white/[0.025]">
+                class="overflow-hidden rounded-xl border border-neutral-200 bg-white shadow-sm dark:border-white/[0.08] dark:bg-white/[0.05]">
                 <div
-                    class="projects-table-grid border-b border-neutral-200 bg-neutral-50 px-4 py-2.5 text-[11px] font-medium text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.025] dark:text-fg-faint">
+                    class="projects-table-grid border-b border-neutral-200 bg-neutral-50 px-4 py-2.5 text-[11px] font-medium text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.05] dark:text-fg-faint">
                     <div>Project</div>
                     <div>Environments</div>
                     <div>Resources</div>
@@ -212,7 +212,7 @@
             </div>
 
             <div x-show="filteredProjects.length === 0"
-                class="flex min-h-52 flex-col items-center justify-center rounded-xl border border-neutral-200 bg-white px-6 text-center dark:border-white/[0.08] dark:bg-white/[0.025]">
+                class="flex min-h-52 flex-col items-center justify-center rounded-xl border border-neutral-200 bg-white px-6 text-center dark:border-white/[0.08] dark:bg-white/[0.05]">
                 <x-reicon name="search" class="mb-3 size-6 text-neutral-300 dark:text-fg-faint" />
                 <p class="text-[13px] font-medium">No matching projects</p>
                 <p class="mt-1 text-[12px] text-neutral-500 dark:text-fg-dim">
diff --git a/resources/views/livewire/project/new/select.blade.php b/resources/views/livewire/project/new/select.blade.php
index aed3b96978..b361a543ae 100644
--- a/resources/views/livewire/project/new/select.blade.php
+++ b/resources/views/livewire/project/new/select.blade.php
@@ -111,7 +111,7 @@
                             <article role="button" tabindex="0" :aria-label="'Deploy ' + application.name"
                                 @click="setType(application.id)" @keydown.enter.self.prevent="setType(application.id)"
                                 @keydown.space.self.prevent="setType(application.id)"
-                                class="group flex min-h-48 cursor-pointer flex-col rounded-xl border border-neutral-200 bg-white p-4 transition-colors hover:border-neutral-300 focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-accent dark:border-white/[0.08] dark:bg-white/[0.025] dark:hover:border-white/[0.14]">
+                                class="group flex min-h-48 cursor-pointer flex-col rounded-xl border border-neutral-200 bg-white p-4 transition-colors hover:border-neutral-300 focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-accent dark:border-white/[0.08] dark:bg-white/[0.05] dark:hover:border-white/[0.14]">
                                 <div class="flex min-w-0 items-start gap-3">
                                     <div
                                         class="flex size-11 shrink-0 items-center justify-center overflow-hidden rounded-xl border border-neutral-200 bg-neutral-50 dark:border-white/[0.08] dark:bg-white/[0.04]">
@@ -157,7 +157,7 @@
                             <article role="button" tabindex="0" :aria-label="'Deploy ' + application.name"
                                 @click="setType(application.id)" @keydown.enter.self.prevent="setType(application.id)"
                                 @keydown.space.self.prevent="setType(application.id)"
-                                class="group flex min-h-48 cursor-pointer flex-col rounded-xl border border-neutral-200 bg-white p-4 transition-colors hover:border-neutral-300 focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-accent dark:border-white/[0.08] dark:bg-white/[0.025] dark:hover:border-white/[0.14]">
+                                class="group flex min-h-48 cursor-pointer flex-col rounded-xl border border-neutral-200 bg-white p-4 transition-colors hover:border-neutral-300 focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-accent dark:border-white/[0.08] dark:bg-white/[0.05] dark:hover:border-white/[0.14]">
                                 <div class="flex min-w-0 items-start gap-3">
                                     <div
                                         class="flex size-11 shrink-0 items-center justify-center overflow-hidden rounded-xl border border-neutral-200 bg-neutral-50 dark:border-white/[0.08] dark:bg-white/[0.04]">
@@ -206,7 +206,7 @@
                             <article role="button" tabindex="0" :aria-label="'Deploy ' + database.name"
                                 @click="setType(database.id)" @keydown.enter.self.prevent="setType(database.id)"
                                 @keydown.space.self.prevent="setType(database.id)"
-                                class="group flex min-h-48 cursor-pointer flex-col rounded-xl border border-neutral-200 bg-white p-4 transition-colors hover:border-neutral-300 focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-accent dark:border-white/[0.08] dark:bg-white/[0.025] dark:hover:border-white/[0.14]">
+                                class="group flex min-h-48 cursor-pointer flex-col rounded-xl border border-neutral-200 bg-white p-4 transition-colors hover:border-neutral-300 focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-accent dark:border-white/[0.08] dark:bg-white/[0.05] dark:hover:border-white/[0.14]">
                                 <div class="flex min-w-0 items-center gap-3">
                                     <div
                                         class="flex size-11 shrink-0 items-center justify-center overflow-hidden rounded-xl border border-neutral-200 bg-neutral-50 dark:border-white/[0.08] dark:bg-white/[0.04]">
@@ -283,7 +283,7 @@
                                     @click="setType('one-click-service-' + service.id)"
                                     @keydown.enter.self.prevent="setType('one-click-service-' + service.id)"
                                     @keydown.space.self.prevent="setType('one-click-service-' + service.id)"
-                                    class="group flex min-h-48 cursor-pointer flex-col rounded-xl border border-neutral-200 bg-white p-4 transition-colors hover:border-neutral-300 focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-accent dark:border-white/[0.08] dark:bg-white/[0.025] dark:hover:border-white/[0.14]">
+                                    class="group flex min-h-48 cursor-pointer flex-col rounded-xl border border-neutral-200 bg-white p-4 transition-colors hover:border-neutral-300 focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-accent dark:border-white/[0.08] dark:bg-white/[0.05] dark:hover:border-white/[0.14]">
                                     <div class="flex min-w-0 items-start gap-3">
                                         <div
                                             class="flex size-11 shrink-0 items-center justify-center overflow-hidden rounded-xl border border-neutral-200 bg-neutral-50 dark:border-white/[0.08] dark:bg-white/[0.04]">
diff --git a/resources/views/livewire/project/resource/index.blade.php b/resources/views/livewire/project/resource/index.blade.php
index 09be827990..025da57b27 100644
--- a/resources/views/livewire/project/resource/index.blade.php
+++ b/resources/views/livewire/project/resource/index.blade.php
@@ -166,9 +166,9 @@
             </div>
 
             <div x-show="viewMode === 'table'"
-                class="overflow-hidden rounded-xl border border-neutral-200 bg-white shadow-sm dark:border-white/[0.08] dark:bg-white/[0.025]">
+                class="overflow-hidden rounded-xl border border-neutral-200 bg-white shadow-sm dark:border-white/[0.08] dark:bg-white/[0.05]">
                 <div
-                    class="environment-resource-grid border-b border-neutral-200 bg-neutral-50 px-4 py-2.5 text-[11px] font-medium text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.025] dark:text-fg-faint">
+                    class="environment-resource-grid border-b border-neutral-200 bg-neutral-50 px-4 py-2.5 text-[11px] font-medium text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.05] dark:text-fg-faint">
                     <div>Resource</div>
                     <div class="resource-type">Type</div>
                     <div>Status</div>
@@ -271,7 +271,7 @@
                 <div class="grid grid-cols-1 gap-3 sm:grid-cols-2 lg:grid-cols-4">
                     <template x-for="item in paginatedResources" :key="item.uuid">
                         <article
-                            class="group relative flex min-h-28 flex-col rounded-xl border border-neutral-200 bg-white p-3 shadow-sm transition-all hover:-translate-y-px hover:border-neutral-300 hover:shadow-md dark:border-white/[0.08] dark:bg-white/[0.025] dark:hover:border-white/[0.14]">
+                            class="group relative flex min-h-28 flex-col rounded-xl border border-neutral-200 bg-white p-3 shadow-sm transition-all hover:-translate-y-px hover:border-neutral-300 hover:shadow-md dark:border-white/[0.08] dark:bg-white/[0.05] dark:hover:border-white/[0.14]">
                             <a :href="item.hrefLink"
                                 @click="if (item.version === 'v5') { $event.preventDefault(); window.location.assign(item.hrefLink) }"
                                 {{ wireNavigate() }} class="absolute inset-0 rounded-xl"
@@ -320,7 +320,7 @@
                 </div>
 
                 <div x-show="filteredResources.length === 0"
-                    class="flex min-h-52 flex-col items-center justify-center rounded-xl border border-neutral-200 bg-white px-6 text-center dark:border-white/[0.08] dark:bg-white/[0.025]">
+                    class="flex min-h-52 flex-col items-center justify-center rounded-xl border border-neutral-200 bg-white px-6 text-center dark:border-white/[0.08] dark:bg-white/[0.05]">
                     <x-reicon name="search" class="mb-3 size-6 text-neutral-300 dark:text-fg-faint" />
                     <p class="text-[13px] font-medium">No matching resources</p>
                     <p class="mt-1 text-[12px] text-neutral-500 dark:text-fg-dim">
@@ -328,7 +328,7 @@
                     </p>
                 </div>
                 <x-client-pagination x-show="filteredResources.length > 0"
-                    class="mt-3 rounded-xl border border-neutral-200 bg-white shadow-sm dark:border-white/[0.08] dark:bg-white/[0.025]"
+                    class="mt-3 rounded-xl border border-neutral-200 bg-white shadow-sm dark:border-white/[0.08] dark:bg-white/[0.05]"
                     summary="filteredResources.length === 0 ? '0 resources' : `${rangeStart}-${rangeEnd} of ${filteredResources.length}`"
                     page-size-model="pageSize" storage-key="coolify.page-size.environment-resources" />
             </div>
diff --git a/resources/views/livewire/project/service/backup-executions.blade.php b/resources/views/livewire/project/service/backup-executions.blade.php
index b5c2057cfd..ee992b9a47 100644
--- a/resources/views/livewire/project/service/backup-executions.blade.php
+++ b/resources/views/livewire/project/service/backup-executions.blade.php
@@ -21,11 +21,17 @@
 
     <x-application.settings-section title="Executions"
         helper="Review backup runs across every database and storage target in this service." flush>
+        @if ($executions->total() > 10)
+            <x-slot:actions>
+                <x-page-size-select model="perPage" livewire />
+            </x-slot:actions>
+        @endif
         @if ($executions->isEmpty())
             <x-empty size="sm" title="No backup executions"
                 description="Execution history appears here after a backup schedule runs." icon-name="browser-terminal" />
         @else
-            <div class="data-table w-full overflow-x-auto">
+            <div class="data-table relative w-full overflow-x-auto">
+                <x-table.loading target="previousPage,nextPage,setPage,perPage" text="Loading executions..." />
                 <div class="data-table-header grid min-w-[820px] grid-cols-[minmax(150px,1.4fr)_100px_100px_110px_110px_90px_48px]">
                     <span>Target</span><span>Type</span><span>Schedule</span><span>Status</span><span>Started</span><span>Size</span><span class="text-right">Actions</span>
                 </div>
@@ -42,7 +48,13 @@
                         wire:click="openExecution('{{ $execution['uuid'] }}')"
                         wire:keydown.enter="openExecution('{{ $execution['uuid'] }}')" role="button" tabindex="0"
                         class="data-table-row grid min-w-[820px] cursor-pointer grid-cols-[minmax(150px,1.4fr)_100px_100px_110px_110px_90px_48px] text-left text-[13px] text-neutral-700 dark:text-fg-dim">
-                        <span class="truncate font-medium text-neutral-950 dark:text-fg" title="{{ $execution['target'] }}">{{ $execution['target'] }}</span>
+                        <span class="flex min-w-0 items-center gap-2 font-medium text-neutral-950 dark:text-fg">
+                            <span class="truncate" title="{{ $execution['target'] }}">{{ $execution['target'] }}</span>
+                            <span tabindex="0" data-tooltip="{{ $execution['s3_tooltip'] }}"
+                                aria-label="{{ $execution['s3_tooltip'] }}" class="shrink-0 text-neutral-500 dark:text-fg-dim">
+                                <x-reicon name="cloud" class="size-3.5" aria-hidden="true" />
+                            </span>
+                        </span>
                         <span>{{ $execution['type'] }}</span><span>{{ $execution['schedule'] }}</span>
                         <span><x-status-badge :status="str($execution['status'])->headline()" :type="$statusType" /></span>
                         <span>{{ $execution['started_at']->diffForHumans() }}</span>
@@ -58,6 +70,12 @@
                         </span>
                     </div>
                 @endforeach
+                @if ($executions->hasPages())
+                    <x-table-pagination :from="$executions->firstItem()" :to="$executions->lastItem()"
+                        :total="$executions->total()" :current-page="$executions->currentPage()" :last-page="$executions->lastPage()"
+                        wire-target="previousPage,nextPage,setPage,perPage"
+                        previous-action="previousPage('executionsPage')" next-action="nextPage('executionsPage')" />
+                @endif
             </div>
         @endif
     </x-application.settings-section>
diff --git a/resources/views/livewire/project/service/configuration.blade.php b/resources/views/livewire/project/service/configuration.blade.php
index bb50575353..5d2f5336bf 100644
--- a/resources/views/livewire/project/service/configuration.blade.php
+++ b/resources/views/livewire/project/service/configuration.blade.php
@@ -144,10 +144,10 @@
 
                         <div :class="viewMode === 'grid'
                             ? 'grid grid-cols-1 gap-3 sm:grid-cols-2'
-                            : 'overflow-x-auto rounded-xl border border-neutral-200 bg-white shadow-sm dark:border-white/[0.08] dark:bg-white/[0.025]'">
+                            : 'overflow-x-auto rounded-xl border border-neutral-200 bg-white shadow-sm dark:border-white/[0.08] dark:bg-white/[0.05]'">
                             @if ($applications->isNotEmpty() || $databases->isNotEmpty())
                                 <div x-cloak x-show="viewMode === 'table'"
-                                    class="grid min-w-[48rem] grid-cols-[minmax(14rem,1fr)_minmax(12rem,1fr)_12rem_5rem] gap-3 border-b border-neutral-200 bg-neutral-50 px-4 py-2.5 text-[11px] font-medium text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.025] dark:text-fg-faint">
+                                    class="grid min-w-[48rem] grid-cols-[minmax(14rem,1fr)_minmax(12rem,1fr)_12rem_5rem] gap-3 border-b border-neutral-200 bg-neutral-50 px-4 py-2.5 text-[11px] font-medium text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.05] dark:text-fg-faint">
                                     <div>Resource</div>
                                     <div>Image</div>
                                     <div class="justify-self-start">Status</div>
diff --git a/resources/views/livewire/project/service/domains.blade.php b/resources/views/livewire/project/service/domains.blade.php
index a02d5ae758..0955e534cf 100644
--- a/resources/views/livewire/project/service/domains.blade.php
+++ b/resources/views/livewire/project/service/domains.blade.php
@@ -15,18 +15,26 @@
     })->values();
 @endphp
 
-<div class="flex flex-col gap-4"
+<div id="service-domains-section" class="flex flex-col gap-4"
     x-data="{
         domainSearch: '',
         modalOpen: @js($showEditDomainModal || $editDomainDnsFailed),
         editingServiceLabel: '',
+        editingDomainBaseline: null,
+        get hasAddressChanges() {
+            return this.modalOpen && this.editingDomainBaseline !== null
+                && JSON.stringify($wire.editingDomainParts) !== this.editingDomainBaseline
+                && !$wire.showPortWarningModal && !$wire.showDomainConflictModal;
+        },
         openEditDomain() {
+            this.editingDomainBaseline = JSON.stringify($wire.editingDomainParts);
             this.editingServiceLabel = $wire.serviceApps.find(app => app.id === $wire.editingServiceApplicationId)?.name || '';
             this.modalOpen = true;
-            this.$nextTick(() => document.getElementById('editingDomainLocal')?.focus?.());
+            this.$nextTick(() => document.getElementById('editingDomainParts-host')?.focus?.());
         },
         closeEditDomain() {
             this.modalOpen = false;
+            this.editingDomainBaseline = null;
             this.editingServiceLabel = '';
         },
         matchesDomainSearch(value) {
@@ -41,37 +49,23 @@
     @if ($hasDnsChecksInProgress)
         <div class="hidden" wire:poll.2000ms="pollDnsChecks" aria-hidden="true"></div>
     @endif
-    <x-application.settings-section id="service-domains-section" title="Domains">
-        @can('update', $service)
-            <x-slot:actions>
-                <x-forms.button wire:click="checkAllDns" wire:loading.attr="disabled"
-                    wire:target="checkAllDns,checkDomainDns">
-                    <x-reicon name="refresh" class="size-3.5" />
-                    Recheck DNS
-                </x-forms.button>
-            </x-slot:actions>
-        @endcan
-
-        @cannot('update', $service)
-            <x-callout type="danger" title="Insufficient permissions">
-                You don't have permission to manage domains. Contact your team administrator for access.
-            </x-callout>
-        @endcannot
-
-        <p class="text-sm text-neutral-500 dark:text-fg-dim">
-            Manage domains and www/non-www redirects for applications in this stack.
-        </p>
-
-    </x-application.settings-section>
+    @cannot('update', $service)
+        <x-callout type="danger" title="Insufficient permissions">
+            You don't have permission to manage domains. Contact your team administrator for access.
+        </x-callout>
+    @endcannot
 
     {{-- Toolbar --}}
     <div class="mt-2 flex flex-wrap items-center gap-2">
-        <p class="min-w-0 flex-1 text-[13px] text-neutral-500 dark:text-fg-dim">
-            {{ $configuredCount }} domain{{ $configuredCount === 1 ? '' : 's' }}
-            @if ($suggestedCount > 0)
-                · {{ $suggestedCount }} not added
-            @endif
-        </p>
+        <div class="min-w-0 flex-1">
+            <h3>Domains</h3>
+            <p class="text-[13px] text-neutral-500 dark:text-fg-dim">
+                {{ $configuredCount }} domain{{ $configuredCount === 1 ? '' : 's' }} across {{ $domainGroups->count() }} service{{ $domainGroups->count() === 1 ? '' : 's' }}
+                @if ($suggestedCount > 0)
+                    · {{ $suggestedCount }} not added
+                @endif
+            </p>
+        </div>
         <div class="ml-auto flex flex-wrap items-center gap-2">
             @if ($domainGroups->isNotEmpty())
                 <div class="relative w-full sm:w-64">
@@ -82,6 +76,13 @@
                 </div>
             @endif
             @can('update', $service)
+                @if ($configuredCount > 0)
+                    <x-forms.button wire:click="checkAllDns" wire:loading.attr="disabled"
+                        wire:target="checkAllDns,checkDomainDns">
+                        <x-reicon name="refresh" class="size-3.5" />
+                        Check all DNS
+                    </x-forms.button>
+                @endif
                 @if ($serviceAppCount > 0)
                     <div class="relative shrink-0">
                         @include('livewire.project.shared.cloudflare-autoconfigure')
@@ -92,12 +93,12 @@
                             <button type="button"
                                 class="button button-highlighted">
                                 <x-reicon name="plus" class="size-3.5" />
-                                Add
+                                Add domain
                             </button>
                         </x-slot:content>
                         <form wire:submit="addDomain" class="application-settings-form flex flex-col gap-4">
                             {{-- Always show which service receives the domain --}}
-                            <x-forms.listbox canGate="update" :canResource="$service" label="Service application" id="newServiceApplicationId" required
+                            <x-forms.listbox canGate="update" :canResource="$service" label="Service application" id="newServiceApplicationId" required portal
                                 helper="Domain will be assigned to this compose service application."
                                 :options="collect($serviceApps)->map(fn ($app) => [
                                     'value' => $app['id'],
@@ -153,12 +154,11 @@
     @elseif (! $hasRows)
         <div class="application-settings-section-body mt-1 w-full scroll-mt-28">
             <x-empty size="sm" title="No domains configured"
-                description="Add your first domain with the + Add button above. Choose which service application receives it."
+                description="Add your first domain with the Add domain button above. Choose which service application receives it."
                 icon-name="globe" />
         </div>
     @else
-        <div wire:key="service-domains-list"
-            class="application-settings-section-body is-flush mt-1 w-full scroll-mt-28 overflow-visible">
+        <div wire:key="service-domains-list" class="flex flex-col gap-3">
             @foreach ($domainGroups as $appId => $rows)
                 @php
                     $app = collect($serviceApps)->firstWhere('id', (int) $appId);
@@ -169,16 +169,17 @@
                 @endphp
                 <section id="service-domain-group-{{ $appId }}" wire:key="service-domain-group-{{ $appId }}"
                     x-show="matchesDomainSearch(@js($heading.' '.$rows->pluck('url')->implode(' ')))"
-                    class="border-b border-neutral-200 last:border-b-0 dark:border-white/10">
-                    <div class="flex w-full flex-wrap items-center gap-3 border-b border-neutral-200 bg-neutral-50 px-4 py-3 dark:border-white/10 dark:bg-white/[0.04]">
+                    class="application-settings-section-body is-flush overflow-visible">
+                    <div class="flex w-full flex-wrap items-center gap-3 rounded-t-lg border-b border-neutral-200 bg-neutral-50 px-4 py-3 dark:border-white/10 dark:bg-white/[0.04]">
                         <span class="min-w-0 flex-1 truncate text-sm font-medium text-black dark:text-white">{{ $heading }}</span>
                         @if ($hasHttpsDomains)
-                            <div class="w-full sm:w-72">
+                            <div class="flex w-full items-center gap-2 sm:w-auto service-domains-https">
+                                <label for="service-force-https-{{ $appId }}-trigger" class="mb-0! whitespace-nowrap text-[12px]!">Redirect HTTP to HTTPS</label>
+                                <x-helper helper="Disable only when Cloudflare Tunnel or another proxy connects to Coolify over HTTP. Keep enabled when Cloudflare uses Full or Full (Strict) SSL." />
                                 <x-forms.listbox canGate="update" :canResource="$service" id="forceHttpsRedirects.{{ $appId }}"
-                                    htmlId="service-force-https-{{ $appId }}"
-                                    label="Redirect HTTP to HTTPS" onChange="updateForceHttps"
+                                    htmlId="service-force-https-{{ $appId }}" preserveValue
+                                    onChange="updateForceHttps"
                                     :onChangeArgs="[(int) $appId]"
-                                    helper="Disable only when Cloudflare Tunnel or another proxy connects to Coolify over HTTP. Keep enabled when Cloudflare uses Full or Full (Strict) SSL."
                                     :options="[
                                         ['value' => true, 'label' => 'Enabled'],
                                         ['value' => false, 'label' => 'Disabled'],
@@ -187,7 +188,7 @@
                         @endif
                     </div>
 
-                    <div wire:key="service-domain-rows-{{ $appId }}-{{ md5(serialize($rows->all())) }}">
+                    <div wire:key="service-domain-rows-{{ $appId }}">
                         @include('livewire.project.service.partials.domain-table', [
                             'rows' => $rows,
                             'domainRows' => $domainRows,
@@ -207,7 +208,7 @@
         </div>
     @endif
 
-    {{-- Edit domain modal: open/close is Alpine-only; server runs only on Save / Continue. --}}
+    {{-- One dialog for the address and domain settings. --}}
     <div class="relative h-auto w-auto" :class="{ 'z-40': modalOpen }"
         @keydown.window.escape="if (modalOpen) { closeEditDomain() }">
         <template x-teleport="body">
@@ -229,7 +230,7 @@
                         class="application-settings-form application-settings-section relative flex max-h-[calc(100dvh-2rem)] w-full flex-col overflow-hidden lg:w-auto lg:min-w-2xl lg:max-w-4xl"
                         style="box-shadow: 0 0 0 1px var(--coollabs-hairline), var(--shadow-modal)">
                         <header class="flex-nowrap!">
-                            <h3 class="min-w-0 flex-1 truncate">Edit domain</h3>
+                            <h3 class="min-w-0 flex-1 truncate">Domain settings</h3>
                             <button type="button" @click="closeEditDomain()" class="icon-button shrink-0"
                                 aria-label="Close">
                                 <x-reicon name="x" class="size-4" />
@@ -238,6 +239,10 @@
                         <div class="application-settings-section-body relative min-h-0 flex-1 overflow-y-auto"
                             style="-webkit-overflow-scrolling: touch;">
                             <form wire:submit="updateDomain" class="flex flex-col gap-4">
+                                <template x-if="modalOpen">
+                                    <x-unsaved-bar action="updateDomain" dirty="hasAddressChanges"
+                                        targets="updateDomain,confirmUpdateDomainDespiteDns" />
+                                </template>
                                 <div x-show="editingServiceLabel" x-cloak class="w-full">
                                     <div class="mb-1.5 flex h-4 w-full items-center gap-1.5">
                                         <label class="mb-0! flex items-center gap-1 text-sm font-medium leading-4">Service application</label>
@@ -261,19 +266,50 @@
                                     </x-callout>
                                 @endif
 
-                                <div class="flex flex-wrap items-center justify-end gap-2 pt-2">
-                                    @if ($editDomainDnsFailed)
-                                        <x-forms.button type="button" isError
-                                            wire:click="confirmUpdateDomainDespiteDns">
+                                @if ($editDomainDnsFailed)
+                                    <div class="flex justify-end">
+                                        <x-forms.button type="button" isError wire:click="confirmUpdateDomainDespiteDns">
                                             Continue
                                         </x-forms.button>
-                                    @else
-                                        <x-forms.button type="submit" wire:target="updateDomain" isHighlighted>
-                                            Save
-                                        </x-forms.button>
-                                    @endif
-                                </div>
+                                    </div>
+                                @endif
                             </form>
+                            @php
+                                $editingRow = $editingIndex !== null ? ($domainRows[$editingIndex] ?? null) : null;
+                            @endphp
+                            @if ($editingRow)
+                                @can('update', $service)
+                                    @php
+                                        $editingAppId = (int) $editingRow['service_application_id'];
+                                        $editingDomainKey = hash('sha256', $editingRow['url'].'|'.$editingAppId);
+                                        $editingNoindex = $service->applications->firstWhere('id', $editingAppId)?->isDomainNoindexed($editingRow['url']);
+                                    @endphp
+                                    <div wire:key="editing-domain-settings-{{ $editingDomainKey }}"
+                                        class="mt-4 grid grid-cols-1 gap-4 border-t border-neutral-200 pt-4 sm:grid-cols-2 dark:border-white/10">
+                                        <p class="sm:col-span-2 text-[12px] text-neutral-500 dark:text-fg-dim">Indexing and redirect changes save automatically.</p>
+                                        <x-forms.listbox id="service-domain-indexing-{{ $editingAppId }}-{{ $editingDomainKey }}"
+                                            label="Search engine indexing" :wire="false" preserveValue
+                                            :value="$editingNoindex ? 'noindex' : 'index'"
+                                            onChange="toggleNoindexDomain"
+                                            :onChangeArgs="[$editingAppId, $editingRow['url']]" portal
+                                            :options="[
+                                                ['value' => 'index', 'label' => 'Indexable'],
+                                                ['value' => 'noindex', 'label' => 'Noindex'],
+                                            ]" />
+                                        <x-forms.listbox id="service-domain-direction-{{ $editingAppId }}-{{ $editingDomainKey }}"
+                                            label="www redirect" :wire="false" :value="$serviceRedirects[$editingAppId] ?? 'both'" preserveValue
+                                            x-effect="value = $wire.serviceRedirects[{{ $editingAppId }}] ?? 'both'"
+                                            helper="Applies to all domains for this service application."
+                                            onChange="updateServiceRedirect" :onChangeArgs="[$editingAppId]" portal
+                                            :options="[
+                                                ['value' => 'both', 'label' => 'No redirect'],
+                                                ['value' => 'www', 'label' => 'Redirect to www'],
+                                                ['value' => 'non-www', 'label' => 'Redirect to non-www'],
+                                            ]" />
+                                    </div>
+                                @endcan
+                            @endif
+
                         </div>
                     </div>
                 </div>
@@ -311,7 +347,8 @@
 
                             <div class="mt-4 flex flex-wrap justify-end gap-2 border-t border-neutral-200 pt-4 dark:border-white/[0.08]">
                                 <x-forms.button type="button"
-                                    @click="modalOpen = false; $wire.call('cancelRemovePort')">
+                                    wire:click="cancelRemovePort"
+                                    @click="modalOpen = false">
                                     Keep required port
                                 </x-forms.button>
                                 <x-forms.button type="button" wire:click="confirmRemovePort"
diff --git a/resources/views/livewire/project/service/edit-compose.blade.php b/resources/views/livewire/project/service/edit-compose.blade.php
index 47b3e732f2..c422f8e928 100644
--- a/resources/views/livewire/project/service/edit-compose.blade.php
+++ b/resources/views/livewire/project/service/edit-compose.blade.php
@@ -25,7 +25,7 @@
     </div>
 
     <div
-        class="flex flex-col items-stretch gap-2 rounded-lg border border-neutral-200 bg-neutral-50 p-1 sm:flex-row sm:flex-wrap sm:items-center dark:border-white/[0.08] dark:bg-white/[0.025]">
+        class="flex flex-col items-stretch gap-2 rounded-lg border border-neutral-200 bg-neutral-50 p-1 sm:flex-row sm:flex-wrap sm:items-center dark:border-white/[0.08] dark:bg-white/[0.05]">
         <x-forms.checkbox label="Escape special characters in labels"
             helper="By default, $ (and other characters) is escaped. A $ in a label is saved as $$. Turn this off to use environment variables inside labels."
             id="isContainerLabelEscapeEnabled" instantSave />
diff --git a/resources/views/livewire/project/service/partials/domain-table.blade.php b/resources/views/livewire/project/service/partials/domain-table.blade.php
index 444d1bfd28..5b4c0d1e11 100644
--- a/resources/views/livewire/project/service/partials/domain-table.blade.php
+++ b/resources/views/livewire/project/service/partials/domain-table.blade.php
@@ -1,7 +1,7 @@
 @php
     $showServiceColumn = $showServiceColumn ?? false;
     $showHeader = $showHeader ?? true;
-    $gridClass = $showServiceColumn ? 'domains-table-grid-compose' : 'domains-table-grid';
+    $gridClass = 'service-domains-overview-grid';
 @endphp
 
 <div class="data-table w-full">
@@ -11,10 +11,12 @@
             @if ($showServiceColumn)
                 <span>Service</span>
             @endif
-            <span>DNS Check</span>
-            <span class="whitespace-nowrap">Search engine indexing</span>
-            <span>Direction</span>
-            <span></span>
+            <span>Protocol redirect</span>
+                <span>Domain redirect</span>
+                <span>Internal port</span>
+                <span>Search indexing</span>
+                <span>DNS status</span>
+            <span class="text-right">Actions</span>
         </div>
     @endif
     @foreach ($rows as $row)
@@ -32,35 +34,28 @@
                 default => 'neutral',
             };
             $dnsLabel = match ($row['dns_status']) {
-                'ok' => 'DNS OK',
+                'ok' => 'DNS matches',
                 'failed' => 'DNS mismatch',
                 'skipped' => 'DNS skipped',
                 'checking' => 'Checking DNS...',
-                'pending' => 'DNS pending',
+                'pending' => 'Not checked',
                 default => 'DNS unknown',
             };
             $serviceLabel = filled($row['service_name'] ?? null)
                 ? \Illuminate\Support\Str::headline($row['service_name'])
                 : '-';
-            $domainParts = $isSuggested ? null : parse_url($row['url']);
+            $publicUrl = getFqdnWithoutPort($row['url']);
+            $domainParts = $isSuggested ? null : parse_url($publicUrl);
+            $isNoindexed = $service->applications->firstWhere('id', $row['service_application_id'])?->isDomainNoindexed($row['url']);
+            $rowDirection = $serviceRedirects[$row['service_application_id']] ?? 'both';
+            $directionLabel = match ($rowDirection) {
+                'www' => 'Redirect to www',
+                'non-www' => 'Redirect to non-www',
+                default => 'Both www and non-www',
+            };
             $faviconUrl = is_array($domainParts) && isset($domainParts['scheme'], $domainParts['host'])
                 ? $domainParts['scheme'].'://'.$domainParts['host'].(isset($domainParts['port']) ? ':'.$domainParts['port'] : '').'/favicon.ico'
                 : null;
-            $redirectPairKey = function (string $url): string {
-                $parts = parse_url($url);
-                if (! is_array($parts) || ! isset($parts['host'])) {
-                    return $url;
-                }
-
-                $host = preg_replace('/^www\./i', '', $parts['host']);
-
-                return strtolower(($parts['scheme'] ?? '').'://'.$host.':'.($parts['port'] ?? '').($parts['path'] ?? ''));
-            };
-            $pairKey = $redirectPairKey($row['url']);
-            $firstPairRowUrl = collect($rows)
-                ->reject(fn ($item) => (bool) ($item['is_suggested'] ?? false))
-                ->first(fn ($item) => $redirectPairKey($item['url']) === $pairKey)['url'] ?? null;
-            $showDirection = ! $isSuggested && $firstPairRowUrl === $row['url'];
             $domainKey = hash('sha256', $row['url'].'|'.($row['service_application_id'] ?? ''));
         @endphp
 
@@ -70,10 +65,9 @@
                 'data-table-row',
                 $gridClass,
                 'domains-row-suggested' => $isSuggested,
-                'domains-row-without-direction' => ! $showDirection,
             ])>
                 <div class="flex min-w-0 flex-col gap-1">
-                    <div class="flex min-w-0 flex-wrap items-center gap-2">
+                    <div class="flex min-w-0 items-center gap-2">
                         @if ($isSuggested)
                             <span
                                 class="min-w-0 text-[13px] text-black sm:truncate dark:text-white"
@@ -93,17 +87,11 @@
                                         class="invisible absolute inset-0 size-4 rounded-sm" />
                                 </span>
                             @endif
-                            <a href="{{ getFqdnWithoutPort($row['url']) }}" target="_blank"
-                                class="min-w-0 flex-1 text-[13px] text-black underline decoration-neutral-300 underline-offset-2 hover:decoration-coollabs sm:truncate dark:text-fg dark:decoration-white/20 dark:hover:decoration-warning"
-                                title="{{ $row['url'] }}">
-                                {{ $row['url'] }}
+                            <a href="{{ $publicUrl }}" target="_blank" rel="noopener noreferrer"
+                                class="min-w-0 flex-1 truncate text-[13px] text-black underline decoration-neutral-300 underline-offset-2 hover:decoration-coollabs [overflow-wrap:anywhere] dark:text-fg dark:decoration-white/20 dark:hover:decoration-warning"
+                                title="{{ $publicUrl }}">
+                                {{ $publicUrl }}
                             </a>
-                            @if (filled($row['internal_port'] ?? null) && (int) $row['internal_port'] > 0)
-                                <span class="table-badge shrink-0"
-                                    title="{{ ($row['has_port_override'] ?? false) ? 'Custom internal port for this domain' : 'Inherited from the Coolify service port' }}">
-                                    Internal port {{ $row['internal_port'] }}
-                                </span>
-                            @endif
                         @endif
                         @if ($isSuggested && ! empty($row['suggestion_label']))
                             <span class="table-badge table-badge-warning shrink-0">{{ $row['suggestion_label'] }}</span>
@@ -124,7 +112,41 @@
                     </div>
                 @endif
 
-                <div class="flex min-w-0 items-center">
+                <div class="service-domain-detail" title="Protocol redirect">
+                    <span class="service-domain-detail-label">Protocol redirect</span>
+                    <span>{{ str_starts_with($row['url'], 'https://') && ($forceHttpsRedirects[$row['service_application_id']] ?? true) ? 'HTTP → HTTPS' : 'Disabled' }}</span>
+                </div>
+                <div class="service-domain-detail" title="{{ $directionLabel }}">
+                    <span class="service-domain-detail-label">Domain redirect</span>
+                    <span>{{ match ($rowDirection) { 'www' => 'non-www → www', 'non-www' => 'www → non-www', default => 'Disabled' } }}</span>
+                </div>
+                <div class="service-domain-detail"
+                    title="{{ ($row['has_port_override'] ?? false) ? 'Custom internal port for this domain' : 'Inherited from the Coolify service port' }}">
+                    <span class="service-domain-detail-label">Internal port</span>
+                    <span @if (filled($row['internal_port'] ?? null)) aria-label="Internal port {{ $row['internal_port'] }}" @endif>{{ $row['internal_port'] ?? '—' }}</span>
+                </div>
+                <div class="service-domain-detail">
+                    <span class="service-domain-detail-label">Search indexing</span>
+                    <span role="img" aria-label="{{ $isNoindexed ? 'Search indexing blocked' : 'Search indexing allowed' }}"
+                        title="{{ $isNoindexed ? 'Search indexing blocked' : 'Search indexing allowed' }}">
+                        <x-reicon :name="$isNoindexed ? 'x' : 'check'" class="size-4" />
+                    </span>
+                </div>
+
+                <div class="service-domain-mobile-summary" aria-label="Domain routing summary">
+                    @if (str_starts_with($row['url'], 'https://') && ($forceHttpsRedirects[$row['service_application_id']] ?? true))
+                        <span>HTTP → HTTPS</span>
+                    @endif
+                    @if (in_array($rowDirection, ['www', 'non-www'], true))
+                        <span>{{ $rowDirection === 'www' ? 'non-www → www' : 'www → non-www' }}</span>
+                    @elseif (! str_starts_with($row['url'], 'https://') || ! ($forceHttpsRedirects[$row['service_application_id']] ?? true))
+                        <span>No redirects</span>
+                    @endif
+                    <span>Port {{ $row['internal_port'] ?? 'missing' }}</span>
+                    <span>{{ $isNoindexed ? 'Noindex' : 'Indexable' }}</span>
+                </div>
+
+                <div class="service-domain-dns flex min-w-0 items-center">
                     @if ($row['dns_status'] === 'failed')
                         <x-status-badge as="button" @click="$dispatch('open-dns-records-modal')" :status="$dnsLabel" :type="$dnsType"
                             title="View DNS records to fix" class="cursor-pointer hover:bg-neutral-200 dark:hover:bg-white/[0.1]" />
@@ -134,55 +156,7 @@
                     @endif
                 </div>
 
-                <div class="min-w-0">
-                    @unless ($isSuggested)
-                        <span class="domains-mobile-label">Search engine indexing</span>
-                    @endunless
-                    @if ($isSuggested)
-                        <span class="text-[13px] text-neutral-500 dark:text-fg-dim">-</span>
-                    @elseif (auth()->user()?->can('update', $service))
-                        <x-forms.listbox id="service-domain-indexing-{{ $row['service_application_id'] }}-{{ $index }}"
-                            :wire="false"
-                            preserveValue
-                            :value="$service->applications->firstWhere('id', $row['service_application_id'])?->isDomainNoindexed($row['url']) ? 'noindex' : 'index'"
-                            onChange="toggleNoindexDomain"
-                            :onChangeArgs="[(int) $row['service_application_id'], $row['url']]" portal :options="[
-                                ['value' => 'index', 'label' => 'Indexable'],
-                                ['value' => 'noindex', 'label' => 'Noindex'],
-                            ]" />
-                    @else
-                        <span class="text-[13px] text-neutral-500 dark:text-fg-dim">
-                            {{ $service->applications->firstWhere('id', $row['service_application_id'])?->isDomainNoindexed($row['url']) ? 'Noindex' : 'Indexable' }}
-                        </span>
-                    @endif
-                </div>
-
-                <div class="min-w-0">
-                    @php
-                        $rowDirection = $serviceRedirects[$row['service_application_id']] ?? 'both';
-                        $directionLabel = match ($rowDirection) {
-                            'www' => 'Redirect to www',
-                            'non-www' => 'Redirect to non-www',
-                            default => 'Allow both',
-                        };
-                    @endphp
-                    @if ($showDirection)
-                        <span class="domains-mobile-label">Direction</span>
-                    @endif
-                    @if ($showDirection && auth()->user()?->can('update', $service))
-                        <x-forms.listbox id="service-domain-direction-{{ $row['service_application_id'] }}-{{ $index }}"
-                            :wire="false" :value="$rowDirection" preserveValue onChange="updateServiceRedirect"
-                            :onChangeArgs="[(int) $row['service_application_id']]" portal :options="[
-                                ['value' => 'both', 'label' => 'Allow www & non-www'],
-                                ['value' => 'www', 'label' => 'Redirect to www'],
-                                ['value' => 'non-www', 'label' => 'Redirect to non-www'],
-                            ]" />
-                    @elseif ($showDirection)
-                        <span class="text-[13px] text-neutral-500 dark:text-fg-dim">{{ $directionLabel }}</span>
-                    @endif
-                </div>
-
-                <div class="flex items-center justify-end gap-1">
+                <div class="service-domain-actions flex items-center justify-end gap-1">
                     @can('update', $service)
                         <button type="button" wire:click="checkDomainDns({{ $index }})"
                             wire:loading.attr="disabled"
@@ -209,8 +183,8 @@
                                 </x-forms.button>
                             @endif
                         @else
-                            <button type="button" wire:click="startEdit({{ $index }})"
-                                class="icon-button shrink-0" title="Edit domain" aria-label="Edit domain">
+                            <button type="button" class="icon-button shrink-0" title="Domain settings" aria-label="Settings for {{ $publicUrl }}"
+                                wire:click="startEdit({{ $index }})" wire:loading.attr="disabled" wire:target="startEdit">
                                 <x-reicon name="settings" class="size-3.5" />
                             </button>
                             <x-modal-confirmation class="!w-auto shrink-0" title="Remove domain?"
diff --git a/resources/views/livewire/project/service/volume-backup/index.blade.php b/resources/views/livewire/project/service/volume-backup/index.blade.php
index f69d3f0db2..e73e095a33 100644
--- a/resources/views/livewire/project/service/volume-backup/index.blade.php
+++ b/resources/views/livewire/project/service/volume-backup/index.blade.php
@@ -60,7 +60,7 @@
         @php
             $selectedSchedule = $selectedDatabaseBackup ?: $selectedVolumeBackup;
         @endphp
-        <x-modal-input :title="'Edit backup schedule'" wireOpen="scheduleModalOpen" :wireIgnore="false" isLarge
+        <x-modal-input :title="'Edit backup schedule'" wireOpen="scheduleModalOpen" :wireIgnore="false" isLarge fixedHeight
             canGate="update" :canResource="$service">
             <x-slot:content><span></span></x-slot:content>
 
@@ -240,7 +240,7 @@
 
             @if ($backups->isNotEmpty() || $databaseBackups->isNotEmpty())
                 <div class="data-table w-full overflow-x-auto" x-show="filteredBackups.length > 0">
-                    <div class="min-w-[59rem]">
+                    <div class="min-w-[64rem]">
                     <div class="data-table-header backup-table-grid service-backup-table-grid">
                         <span>Target</span>
                         <span>Type</span>
@@ -268,6 +268,8 @@
                                 default => 'neutral',
                             };
                             $databaseBackupId = 'database:'.$databaseBackup->id;
+                            $databaseS3 = $databaseBackup->s3?->team_id === currentTeam()->id ? $databaseBackup->s3 : null;
+                            $databaseS3Tooltip = ! $databaseBackup->save_s3 ? 'S3 storage: Not configured' : ($databaseS3 ? 'S3 storage: '.$databaseS3->name.' (bucket: '.$databaseS3->bucket.')' : 'S3 storage: Unavailable');
                         @endphp
                         <div wire:key="database-backup-{{ $databaseBackup->uuid }}"
                             x-show="isVisible(@js($databaseBackupId))"
@@ -282,14 +284,19 @@
                             <span>{{ $databaseBackup->frequency }}</span>
                             <span><x-status-badge :status="$statusLabel" :type="$statusType" /></span>
                             <span>
-                                <x-status-badge :status="$databaseBackup->save_s3 ? ($databaseBackup->s3 ? 'Configured' : 'Unavailable') : 'Not set'"
-                                    :type="$databaseBackup->save_s3 ? ($databaseBackup->s3 ? 'success' : 'error') : 'neutral'" />
+                                <x-status-badge :status="$databaseBackup->save_s3 ? ($databaseS3 ? 'Configured' : 'Unavailable') : 'Not set'"
+                                    :type="$databaseBackup->save_s3 ? ($databaseS3 ? 'success' : 'error') : 'neutral'"
+                                    :data-tooltip="$databaseS3Tooltip" :aria-label="$databaseS3Tooltip" tabindex="0" />
                             </span>
                             <span>{{ $latestExecution?->finished_at?->diffForHumans() ?? ($status === 'running' ? 'Running now' : 'Never') }}</span>
-                            <span class="flex justify-end">
+                            <span class="flex justify-end gap-2" x-on:keydown.enter.stop>
                                 <x-forms.button type="button" canGate="update" :canResource="$service"
+                                    :disabled="! str($databaseBackup->database->status)->startsWith('running')"
+                                    :tooltip="! str($databaseBackup->database->status)->startsWith('running') ? 'The database must be running to start a backup.' : null"
                                     wire:click.stop="backupNow('database', '{{ $databaseBackup->uuid }}')"
                                     wire:target="backupNow('database', '{{ $databaseBackup->uuid }}')">Back up now</x-forms.button>
+                                <x-forms.button type="button" canGate="update" :canResource="$service"
+                                    wire:click.stop="openSchedule('{{ $databaseBackup->uuid }}')">Settings</x-forms.button>
                             </span>
                         </div>
                     @endforeach
@@ -297,6 +304,8 @@
                     @foreach ($backups as $backup)
                         @php
                             $latestExecution = $backup->latestExecution;
+                            $volumeS3 = $backup->s3?->team_id === currentTeam()->id ? $backup->s3 : null;
+                            $volumeS3Tooltip = ! $backup->save_s3 ? 'S3 storage: Not configured' : ($volumeS3 ? 'S3 storage: '.$volumeS3->name.' (bucket: '.$volumeS3->bucket.')' : 'S3 storage: Unavailable');
                             $status = $latestExecution?->status;
                             $statusLabel = match ($status) {
                                 'running' => 'In progress',
@@ -324,17 +333,20 @@
                             <span>{{ $backup->targetType() }}</span>
                             <span>{{ $backup->frequency }}</span>
                             <span><x-status-badge :status="$statusLabel" :type="$statusType" /></span>
-                            <span title="{{ $backup->save_s3 ? ($backup->s3?->name ?? 'S3 storage unavailable') : 'S3 storage is not configured' }}">
-                                <x-status-badge :status="$backup->save_s3 ? ($backup->s3 ? 'Configured' : 'Unavailable') : 'Not set'"
-                                    :type="$backup->save_s3 ? ($backup->s3 ? 'success' : 'error') : 'neutral'" />
+                            <span>
+                                <x-status-badge :status="$backup->save_s3 ? ($volumeS3 ? 'Configured' : 'Unavailable') : 'Not set'"
+                                    :type="$backup->save_s3 ? ($volumeS3 ? 'success' : 'error') : 'neutral'"
+                                    :data-tooltip="$volumeS3Tooltip" :aria-label="$volumeS3Tooltip" tabindex="0" />
                             </span>
                             <span>
                                 {{ $latestExecution?->finished_at?->diffForHumans() ?? ($status === 'running' ? 'Running now' : 'Never') }}
                             </span>
-                            <span class="flex justify-end">
+                            <span class="flex justify-end gap-2" x-on:keydown.enter.stop>
                                 <x-forms.button type="button" canGate="update" :canResource="$service"
                                     wire:click.stop="backupNow('storage', '{{ $backup->uuid }}')"
                                     wire:target="backupNow('storage', '{{ $backup->uuid }}')">Back up now</x-forms.button>
+                                <x-forms.button type="button" canGate="update" :canResource="$service"
+                                    wire:click.stop="openSchedule('{{ $backup->uuid }}')">Settings</x-forms.button>
                             </span>
                         </div>
                     @endforeach
diff --git a/resources/views/livewire/project/shared/danger.blade.php b/resources/views/livewire/project/shared/danger.blade.php
index 081e1585d5..487ffe691f 100644
--- a/resources/views/livewire/project/shared/danger.blade.php
+++ b/resources/views/livewire/project/shared/danger.blade.php
@@ -40,7 +40,7 @@
                             confirmationLabel="Enter the resource name to confirm permanent deletion"
                             shortConfirmationLabel="Resource name" />
                     @else
-                        <x-forms.button disabled tooltip="You do not have permission to delete this resource.">
+                        <x-forms.button isError disabled tooltip="You do not have permission to delete this resource.">
                             Delete {{ $resourceLabel }}
                         </x-forms.button>
                     @endif
diff --git a/resources/views/livewire/project/shared/destination.blade.php b/resources/views/livewire/project/shared/destination.blade.php
index 5aba6c9ece..6af96038fb 100644
--- a/resources/views/livewire/project/shared/destination.blade.php
+++ b/resources/views/livewire/project/shared/destination.blade.php
@@ -36,7 +36,7 @@
                         <a href="{{ route('server.show', ['server_uuid' => data_get($resource, 'destination.server.uuid')]) }}"
                             {{ wireNavigate() }} class="button">Open server</a>
                         <x-application.restart-limit-warning :application="$resource" />
-                        <x-status-summary :status="$resource->status" />
+                        <x-status-summary :status="$resource->status" align="right" />
                         @if ($hasAdditionalDestinations)
                             <x-forms.button canGate="deploy" :canResource="$resource"
                                 wire:click="redeploy('{{ data_get($resource, 'destination.id') }}','{{ data_get($resource, 'destination.server.id') }}')">
diff --git a/resources/views/livewire/project/shared/environment-variable/show.blade.php b/resources/views/livewire/project/shared/environment-variable/show.blade.php
index a2231ff49c..aaa1b185d8 100644
--- a/resources/views/livewire/project/shared/environment-variable/show.blade.php
+++ b/resources/views/livewire/project/shared/environment-variable/show.blade.php
@@ -86,7 +86,8 @@
         <div class="justify-self-end">
             {{-- Open modal immediately (Alpine); decrypt value in a follow-up Livewire request. --}}
             <x-modal-input title="Edit environment variable" :closeOutside="false" :wireIgnore="false"
-                wireOpen="editorOpen">
+                wireOpen="editorOpen"
+                @environment-variable-updated.window="if ($event.detail.envId === @js($env->id)) modalOpen = false">
                 <x-slot:content>
                     <button type="button" wire:click="loadValues" data-env-settings-trigger class="icon-button shrink-0"
                         title="Edit environment variable" aria-label="Edit environment variable">
@@ -219,26 +220,32 @@
 
                     @if ($canUpdate || auth()->user()?->can('delete', $this->env))
                         <div
-                            class="flex flex-wrap justify-end gap-2 border-t border-neutral-200 pt-4 dark:border-white/[0.07]">
-                            @if ($canUpdate && !$isLocked && !$isMagicVariable)
-                                <x-forms.button type="button" wire:click="lock">Lock</x-forms.button>
-                            @endif
-                            @can('delete', $this->env)
-                                @if (!$isMagicVariable)
-                                    <x-modal-confirmation title="Confirm Environment Variable Deletion?" isErrorButton
-                                        buttonTitle="Delete" submitAction="delete"
-                                        :actions="['The selected environment variable will be permanently deleted.']"
-                                        confirmationText="{{ $key }}"
-                                        confirmationLabel="Please confirm the execution of the actions by entering the Environment Variable Name below"
-                                        shortConfirmationLabel="Environment Variable Name" :confirmWithPassword="false"
-                                        step2ButtonText="Permanently Delete" />
+                            class="flex flex-wrap items-center justify-between gap-2 border-t border-neutral-200 pt-4 dark:border-white/[0.07]">
+                            <div data-environment-variable-delete-action>
+                                @can('delete', $this->env)
+                                    @if (!$isMagicVariable)
+                                        <x-modal-confirmation title="Confirm Environment Variable Deletion?" isErrorButton
+                                            buttonTitle="Delete" submitAction="delete"
+                                            :actions="['The selected environment variable will be permanently deleted.']"
+                                            confirmationText="{{ $key }}"
+                                            confirmationLabel="Please confirm the execution of the actions by entering the Environment Variable Name below"
+                                            shortConfirmationLabel="Environment Variable Name" :confirmWithPassword="false"
+                                            step2ButtonText="Permanently Delete" />
+                                    @endif
+                                @endcan
+                            </div>
+                            <div class="ml-auto flex flex-wrap gap-2" data-environment-variable-update-actions>
+                                @if ($canUpdate && !$isLocked && !$isMagicVariable)
+                                    <x-forms.button type="button" wire:click="lock">Lock</x-forms.button>
                                 @endif
-                            @endcan
-                            @if ($canUpdate)
-                                <x-forms.button type="submit" :disabled="$isDisabled" @click="modalOpen = false">
-                                    Update variable
-                                </x-forms.button>
-                            @endif
+                                @if ($canUpdate && !$isDisabled)
+                                    <fieldset disabled wire:dirty.attr.remove="disabled">
+                                        <x-forms.button type="submit" isHighlighted wire:target="submit">
+                                            Update variable
+                                        </x-forms.button>
+                                    </fieldset>
+                                @endif
+                            </div>
                         </div>
                     @endif
                 </form>
diff --git a/resources/views/livewire/project/shared/execute-container-command.blade.php b/resources/views/livewire/project/shared/execute-container-command.blade.php
index edb53745ca..dabd523f94 100644
--- a/resources/views/livewire/project/shared/execute-container-command.blade.php
+++ b/resources/views/livewire/project/shared/execute-container-command.blade.php
@@ -106,11 +106,11 @@
                 },
             }">
             <div data-terminal-session-canvas
-                class="application-console-shell flex h-full min-h-0 flex-col overflow-hidden rounded-lg p-3 sm:p-6"
+                class="application-console-shell flex h-full min-h-0 flex-col overflow-hidden rounded-lg"
                 :data-console-theme="consoleTheme"
                 :style="{ '--terminal-scrollbar': themeAccents[consoleTheme] }">
                 <header
-                    class="terminal-session-toolbar absolute top-3 right-3 left-3 z-20 flex items-center gap-3 text-white select-none">
+                    class="terminal-session-toolbar flex items-center gap-3 text-white select-none">
                     @if ($type === 'server')
                         <div class="terminal-session-target-trigger flex h-8 min-w-0 max-w-sm flex-1 items-center gap-2 rounded-md px-2.5 text-xs font-medium text-white/70"
                             x-data="{ autoConnected: false }"
@@ -150,7 +150,7 @@
                                         </svg>
                                     </button>
                                     <div x-cloak x-show="containerOpen" x-transition.origin.top.left
-                                        class="terminal-target-picker terminal-target-list absolute top-11 left-0 z-50 max-h-72 w-80 overflow-y-auto rounded-lg border p-1 shadow-[0_18px_50px_rgba(0,0,0,0.35)]">
+                                        class="terminal-target-picker terminal-target-list absolute top-11 left-0 z-50 max-h-72 w-80 overflow-y-auto rounded-lg border p-1 shadow-[var(--shadow-dropdown)]">
                                         <template x-for="option in containerOptions" :key="option.value">
                                             <button type="button"
                                                 class="flex h-8 w-full items-center gap-2 rounded-md px-2 text-left text-[11px] text-white/65 transition-colors hover:bg-white/[0.07] hover:text-white"
@@ -175,12 +175,12 @@
                         :theme-accents="$consoleThemeAccents" />
                 </header>
 
-                <div class="terminal-session-panel mt-8 flex min-h-0 flex-1 flex-col overflow-hidden">
+                <div class="terminal-session-panel flex min-h-0 flex-1 flex-col overflow-hidden p-3 sm:p-6">
                 <div class="application-console-block min-h-0 flex-1">
                     @if ($type !== 'server' && $containers->count() > 1)
                         <div x-cloak x-show="!targetChosen" data-terminal-target-picker="launcher"
                             class="absolute inset-0 z-20 flex items-start justify-start p-6 sm:p-10">
-                            <div class="terminal-target-picker w-full max-w-md rounded-lg border p-2 shadow-[0_18px_50px_rgba(0,0,0,0.28)]">
+                            <div class="terminal-target-picker w-full max-w-md rounded-lg border p-2 shadow-[var(--shadow-dropdown)]">
                                 <div class="px-2 pt-1 pb-2">
                                     <div class="text-sm font-semibold text-white/80">Start a terminal session</div>
                                     <div class="mt-0.5 text-[11px] text-white/45">
diff --git a/resources/views/livewire/project/shared/get-logs.blade.php b/resources/views/livewire/project/shared/get-logs.blade.php
index dc64666e2f..b5e9c21039 100644
--- a/resources/views/livewire/project/shared/get-logs.blade.php
+++ b/resources/views/livewire/project/shared/get-logs.blade.php
@@ -295,7 +295,7 @@
         @if ($streamLogs)
             <div class="sr-only" wire:poll.2000ms="getLogs(true)" aria-hidden="true"></div>
         @endif
-        <div x-show="expanded" {{ $collapsible ? 'x-collapse' : '' }}
+        <div x-show="expanded" {{ $collapsible ? 'x-collapse.duration.200ms' : '' }}
             :class="fullscreen ? 'fullscreen flex flex-col !overflow-visible' : 'relative w-full mx-auto'"
             :style="fullscreen ? 'max-height: none !important; height: 100% !important;' : ''">
             <div class="runtime-log-panel"
diff --git a/resources/views/livewire/project/shared/storages/all.blade.php b/resources/views/livewire/project/shared/storages/all.blade.php
index 25a4fd7492..98521c8204 100644
--- a/resources/views/livewire/project/shared/storages/all.blade.php
+++ b/resources/views/livewire/project/shared/storages/all.blade.php
@@ -21,10 +21,10 @@
                 <span class="volumes-col-source">Source Path</span>
                 <span>Destination Path</span>
                 @if ($supportsPreviewSuffix)
-                    <span class="volumes-col-pr"
-                        title="Whether preview deployments receive an isolated -pr-N volume suffix.">
-                        PR suffix
-                    </span>
+                    <div class="volumes-col-pr flex items-center gap-1.5">
+                        <span>PR suffix</span>
+                        <x-helper helper="Adds -pr-N to the storage name or path so each preview uses isolated data. Disabling it shares production data with previews." />
+                    </div>
                 @endif
                 <span class="volumes-col-backup text-center">Backup</span>
                 @if ($showActionsColumn)
@@ -74,7 +74,10 @@
 
                             @if ($supportsPreviewSuffix)
                                 <div class="volumes-col-pr min-w-0">
-                                    <span class="volumes-mobile-label volumes-field-label">PR suffix</span>
+                                    <div class="volumes-mobile-label volumes-field-label flex items-center gap-1.5">
+                                        <span>PR suffix</span>
+                                        <x-helper helper="Adds -pr-N to the storage name or path so each preview uses isolated data. Disabling it shares production data with previews." />
+                                    </div>
                                     <span>{{ $form['isPreviewSuffixEnabled'] ? 'Add suffix' : 'Share volume' }}</span>
                                 </div>
                             @endif
@@ -82,16 +85,22 @@
                             <div class="volumes-col-backup flex items-center justify-center gap-1.5">
                                 <span class="volumes-mobile-label volumes-field-label">Backup</span>
                                 @if ($hasEnabledBackup)
-                                    <a @if ($backupUrl) href="{{ $backupUrl }}" @endif title="Volume backup is enabled">
-                                        <svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24"
-                                            stroke-width="2" stroke="currentColor" class="size-4">
-                                            <path stroke-linecap="round" stroke-linejoin="round" d="m4.5 12.75 6 6 9-13.5" />
-                                        </svg>
-                                    </a>
-                                    <span @class(['table-badge', 'table-badge-success' => $hasS3Backup])
-                                        title="{{ $hasS3Backup ? 'Backups are saved to S3' : 'Backups are stored locally only' }}">
-                                        {{ $hasS3Backup ? 'S3' : 'Local' }}
-                                    </span>
+                                    @if ($backupUrl)
+                                        <a href="{{ $backupUrl }}" @class([
+                                            'table-badge underline-offset-2 hover:underline',
+                                            'table-badge-success' => $hasS3Backup,
+                                        ])
+                                            title="Volume backup is enabled"
+                                            aria-label="{{ $hasS3Backup ? 'Backups are saved to S3' : 'Backups are stored locally only' }}">
+                                            {{ $hasS3Backup ? 'S3' : 'Local' }}
+                                        </a>
+                                    @else
+                                        <span @class(['table-badge', 'table-badge-success' => $hasS3Backup])
+                                            title="Volume backup is enabled"
+                                            aria-label="{{ $hasS3Backup ? 'Backups are saved to S3' : 'Backups are stored locally only' }}">
+                                            {{ $hasS3Backup ? 'S3' : 'Local' }}
+                                        </span>
+                                    @endif
                                 @else
                                     <span class="data-table-cell-dash">-</span>
                                 @endif
@@ -103,10 +112,10 @@
                                     @if ($canUpdate)
                                         <x-modal-input title="Configure Volume Backup" :wireIgnore="false">
                                             <x-slot:content>
-                                                <button type="button" class="icon-button" title="Configure backup"
-                                                    aria-label="Configure backup">
-                                                    <x-reicon name="database" class="size-4" />
-                                                </button>
+                                                <x-forms.button type="button" class="!px-2.5 !text-xs" canGate="update"
+                                                    :canResource="$resource">
+                                                    Backup
+                                                </x-forms.button>
                                             </x-slot:content>
                                             @if ($resource instanceof \App\Models\Application)
                                                 <livewire:project.application.backup.create :application="$resource"
@@ -165,27 +174,36 @@
 
                             @if ($supportsPreviewSuffix)
                                 <div class="volumes-col-pr min-w-0">
-                                    <span class="volumes-mobile-label volumes-field-label">PR suffix</span>
-                                    <x-forms.listbox id="forms.{{ $id }}.isPreviewSuffixEnabled" :options="[
+                                    <div class="volumes-mobile-label volumes-field-label flex items-center gap-1.5">
+                                        <span>PR suffix</span>
+                                        <x-helper helper="Adds -pr-N to the storage name or path so each preview uses isolated data. Disabling it shares production data with previews." />
+                                    </div>
+                                    <x-forms.listbox id="forms.{{ $id }}.isPreviewSuffixEnabled" portal :options="[
                                         ['value' => true, 'label' => 'Add suffix'],
                                         ['value' => false, 'label' => 'Share volume'],
-                                    ]" />
+                                    ]" canGate="update" :canResource="$resource" />
                                 </div>
                             @endif
 
                             <div class="volumes-col-backup flex items-center justify-center gap-1.5">
                                 <span class="volumes-mobile-label volumes-field-label">Backup</span>
                                 @if ($hasEnabledBackup)
-                                    <a @if ($backupUrl) href="{{ $backupUrl }}" @endif title="Volume backup is enabled">
-                                        <svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24"
-                                            stroke-width="2" stroke="currentColor" class="size-4">
-                                            <path stroke-linecap="round" stroke-linejoin="round" d="m4.5 12.75 6 6 9-13.5" />
-                                        </svg>
-                                    </a>
-                                    <span @class(['table-badge', 'table-badge-success' => $hasS3Backup])
-                                        title="{{ $hasS3Backup ? 'Backups are saved to S3' : 'Backups are stored locally only' }}">
-                                        {{ $hasS3Backup ? 'S3' : 'Local' }}
-                                    </span>
+                                    @if ($backupUrl)
+                                        <a href="{{ $backupUrl }}" @class([
+                                            'table-badge underline-offset-2 hover:underline',
+                                            'table-badge-success' => $hasS3Backup,
+                                        ])
+                                            title="Volume backup is enabled"
+                                            aria-label="{{ $hasS3Backup ? 'Backups are saved to S3' : 'Backups are stored locally only' }}">
+                                            {{ $hasS3Backup ? 'S3' : 'Local' }}
+                                        </a>
+                                    @else
+                                        <span @class(['table-badge', 'table-badge-success' => $hasS3Backup])
+                                            title="Volume backup is enabled"
+                                            aria-label="{{ $hasS3Backup ? 'Backups are saved to S3' : 'Backups are stored locally only' }}">
+                                            {{ $hasS3Backup ? 'S3' : 'Local' }}
+                                        </span>
+                                    @endif
                                 @else
                                     <span class="data-table-cell-dash">-</span>
                                 @endif
@@ -200,10 +218,10 @@
                                 @if ($showBackupAction)
                                     <x-modal-input title="Configure Volume Backup" :wireIgnore="false">
                                         <x-slot:content>
-                                            <button type="button" class="icon-button" title="Configure backup"
-                                                aria-label="Configure backup">
-                                                <x-reicon name="database" class="size-4" />
-                                            </button>
+                                            <x-forms.button type="button" class="!px-2.5 !text-xs" canGate="update"
+                                                :canResource="$resource">
+                                                Backup
+                                            </x-forms.button>
                                         </x-slot:content>
                                         @if ($resource instanceof \App\Models\Application)
                                             <livewire:project.application.backup.create :application="$resource"
@@ -218,10 +236,10 @@
                                 @elseif (method_exists($resource, 'isBackupSolutionAvailable') && $resource->isBackupSolutionAvailable())
                                     <x-modal-input title="New Scheduled Backup" :wireIgnore="false">
                                         <x-slot:content>
-                                            <button type="button" class="icon-button" title="Configure backup"
-                                                aria-label="Configure backup">
-                                                <x-reicon name="database" class="size-4" />
-                                            </button>
+                                            <x-forms.button type="button" class="!px-2.5 !text-xs" canGate="update"
+                                                :canResource="$resource">
+                                                Backup
+                                            </x-forms.button>
                                         </x-slot:content>
                                         <livewire:project.database.create-scheduled-backup :database="$resource"
                                             wire:key="configure-database-backup-{{ $id }}" />
diff --git a/resources/views/livewire/project/shared/storages/volume-backups/executions.blade.php b/resources/views/livewire/project/shared/storages/volume-backups/executions.blade.php
index 784843f6f0..9e7b494128 100644
--- a/resources/views/livewire/project/shared/storages/volume-backups/executions.blade.php
+++ b/resources/views/livewire/project/shared/storages/volume-backups/executions.blade.php
@@ -25,7 +25,7 @@
             @if ($executionCount > 0)
                 <div class="data-table w-full overflow-x-auto">
                     <div
-                        class="data-table-header volume-backup-executions-grid border-b border-neutral-200 bg-neutral-50 dark:border-white/[0.08] dark:bg-white/[0.025]">
+                        class="data-table-header volume-backup-executions-grid border-b border-neutral-200 bg-neutral-50 dark:border-white/[0.08] dark:bg-white/[0.05]">
                         <span>Status</span>
                         <span>Archive</span>
                         <span>Time</span>
@@ -129,7 +129,7 @@
 
                             @if ($execution->message)
                                 <pre
-                                    class="volume-backup-execution-message col-span-6 mt-2 max-h-32 overflow-auto rounded-lg border border-neutral-200 bg-neutral-50 p-2 text-[11px] whitespace-pre-wrap text-neutral-600 dark:border-white/[0.08] dark:bg-white/[0.025] dark:text-fg-dim">{{ $execution->message }}</pre>
+                                    class="volume-backup-execution-message col-span-6 mt-2 max-h-32 overflow-auto rounded-lg border border-neutral-200 bg-neutral-50 p-2 text-[11px] whitespace-pre-wrap text-neutral-600 dark:border-white/[0.08] dark:bg-white/[0.05] dark:text-fg-dim">{{ $execution->message }}</pre>
                             @endif
                         </div>
                     @endforeach
diff --git a/resources/views/livewire/project/shared/storages/volume-backups/general.blade.php b/resources/views/livewire/project/shared/storages/volume-backups/general.blade.php
index 0a33eaec90..5b4ece52f1 100644
--- a/resources/views/livewire/project/shared/storages/volume-backups/general.blade.php
+++ b/resources/views/livewire/project/shared/storages/volume-backups/general.blade.php
@@ -16,7 +16,7 @@
             </div>
         </x-slot:actions>
 
-        <div class="mb-4 flex items-center justify-between gap-3 rounded-lg bg-neutral-50 px-3 py-2.5 ring-1 ring-neutral-200 dark:bg-white/[0.025] dark:ring-white/[0.07]">
+        <div class="mb-4 flex items-center justify-between gap-3 rounded-lg bg-neutral-50 px-3 py-2.5 ring-1 ring-neutral-200 dark:bg-white/[0.05] dark:ring-white/[0.07]">
             <span class="text-[12px] text-neutral-500 dark:text-fg-dim">
                 {{ $backup?->targetType() ?? ($storage instanceof \App\Models\LocalFileVolume ? 'Directory' : 'Volume') }}
             </span>
diff --git a/resources/views/livewire/project/shared/storages/volume-backups/s3.blade.php b/resources/views/livewire/project/shared/storages/volume-backups/s3.blade.php
index eeaca78479..7c3f471bfa 100644
--- a/resources/views/livewire/project/shared/storages/volume-backups/s3.blade.php
+++ b/resources/views/livewire/project/shared/storages/volume-backups/s3.blade.php
@@ -1,31 +1,21 @@
 @if ($availableS3Storages->isEmpty())
-    <section class="application-settings-section">
-        <div class="application-settings-section-header">
-            <div>
-                <h2>S3 storage</h2>
-                <p>Send volume backup archives to a validated object storage destination.</p>
-            </div>
-        </div>
-        <div class="application-settings-section-body is-flush">
-            <x-empty title="No validated S3 storage"
-                description="Add and validate an S3 storage destination before enabling remote backups."
-                icon-name="storages">
-                <x-slot:contents>
-                    <a class="button" {{ wireNavigate() }} href="{{ route('storage.index') }}">Open S3 storage</a>
-                </x-slot:contents>
-            </x-empty>
-        </div>
-    </section>
+    <x-application.settings-section title="S3 storage"
+        description="Send volume backup archives to a validated object storage destination." flush>
+        <x-empty title="No validated S3 storage"
+            description="Add and validate an S3 storage destination before enabling remote backups."
+            icon-name="storages">
+            <x-slot:contents>
+                <a class="button" {{ wireNavigate() }} href="{{ route('storage.index') }}">Open S3 storage</a>
+            </x-slot:contents>
+        </x-empty>
+    </x-application.settings-section>
 @else
     <form wire:submit="save">
         <x-unsaved-bar action="save" />
 
-        <section class="application-settings-section">
-            <div class="application-settings-section-header">
-                <div>
-                    <h2>S3 storage</h2>
-                    <p>Choose where remote copies are stored and whether local archives are retained.</p>
-                </div>
+        <x-application.settings-section title="S3 storage"
+            description="Choose where remote copies are stored and whether local archives are retained.">
+            <x-slot:actions>
                 @if (! $saveToS3)
                     <x-forms.button type="button" wire:click="toggleS3" wire:loading.attr="disabled"
                         wire:target="toggleS3" isHighlighted canGate="update" :canResource="$resource">
@@ -37,8 +27,8 @@
                         Disable S3
                     </x-forms.button>
                 @endif
-            </div>
-            <div class="application-settings-section-body grid gap-4 sm:grid-cols-2">
+            </x-slot:actions>
+            <div class="grid gap-4 sm:grid-cols-2">
                 <x-forms.listbox canGate="update" :canResource="$resource" id="s3StorageId" label="S3 storage" :required="$saveToS3"
                     :disabled="! auth()->user()?->can('update', $resource)"
                     :options="$availableS3Storages->map(fn ($s3Storage) => [
@@ -51,6 +41,6 @@
                         ['value' => true, 'label' => 'Delete after S3 upload'],
                     ]" />
             </div>
-        </section>
+        </x-application.settings-section>
     </form>
 @endif
diff --git a/resources/views/livewire/project/shared/tags.blade.php b/resources/views/livewire/project/shared/tags.blade.php
index bc5b266684..1fb1c9d6ad 100644
--- a/resources/views/livewire/project/shared/tags.blade.php
+++ b/resources/views/livewire/project/shared/tags.blade.php
@@ -33,8 +33,7 @@
                     {{ $tag->name }}
                 </span>
                 @can('update', $resource)
-                    <x-forms.button wire:click="deleteTag('{{ $tag->id }}')"
-                        class="h-7! text-neutral-500 dark:text-fg-dim">
+                    <x-forms.button isError wire:click="deleteTag('{{ $tag->id }}')" class="h-7!">
                         Remove
                     </x-forms.button>
                 @endcan
diff --git a/resources/views/livewire/project/show.blade.php b/resources/views/livewire/project/show.blade.php
index 2b54948a8e..b5fbf3485f 100644
--- a/resources/views/livewire/project/show.blade.php
+++ b/resources/views/livewire/project/show.blade.php
@@ -123,7 +123,7 @@
                 <div class="grid grid-cols-1 gap-3 sm:grid-cols-2 lg:grid-cols-4">
                     <template x-for="environment in paginatedEnvironments" :key="environment.uuid">
                         <article
-                            class="group relative flex min-h-28 flex-col rounded-xl border border-neutral-200 bg-white p-3 shadow-sm transition-all hover:-translate-y-px hover:border-neutral-300 hover:shadow-md dark:border-white/[0.08] dark:bg-white/[0.025] dark:hover:border-white/[0.14]">
+                            class="group relative flex min-h-28 flex-col rounded-xl border border-neutral-200 bg-white p-3 shadow-sm transition-all hover:-translate-y-px hover:border-neutral-300 hover:shadow-md dark:border-white/[0.08] dark:bg-white/[0.05] dark:hover:border-white/[0.14]">
                             <a :href="environment.href" {{ wireNavigate() }} class="absolute inset-0 rounded-xl"
                                 :aria-label="`Open ${environment.name}`"></a>
 
@@ -165,15 +165,15 @@
                         </article>
                     </template>
                 </div>
-                <x-client-pagination x-show="filteredEnvironments.length > 0" class="mt-3 rounded-xl border border-neutral-200 bg-white shadow-sm dark:border-white/[0.08] dark:bg-white/[0.025]"
+                <x-client-pagination x-show="filteredEnvironments.length > 0" class="mt-3 rounded-xl border border-neutral-200 bg-white shadow-sm dark:border-white/[0.08] dark:bg-white/[0.05]"
                     summary="`${rangeStart}-${rangeEnd} of ${filteredEnvironments.length}`" page-size-model="pageSize"
                     storage-key="coolify.page-size.project-environments" :options="[12, 24, 48, 96]" />
             </div>
 
             <div x-show="viewMode === 'table'"
-                class="overflow-hidden rounded-xl border border-neutral-200 bg-white shadow-sm dark:border-white/[0.08] dark:bg-white/[0.025]">
+                class="overflow-hidden rounded-xl border border-neutral-200 bg-white shadow-sm dark:border-white/[0.08] dark:bg-white/[0.05]">
                 <div
-                    class="environments-table-grid border-b border-neutral-200 bg-neutral-50 px-4 py-2.5 text-[11px] font-medium text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.025] dark:text-fg-faint">
+                    class="environments-table-grid border-b border-neutral-200 bg-neutral-50 px-4 py-2.5 text-[11px] font-medium text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.05] dark:text-fg-faint">
                     <div>Environment</div>
                     <div class="environment-resource-count">Resources</div>
                     <div class="environment-description">Description</div>
@@ -222,7 +222,7 @@
             </div>
 
             <div x-show="filteredEnvironments.length === 0"
-                class="flex min-h-52 flex-col items-center justify-center rounded-xl border border-neutral-200 bg-white px-6 text-center dark:border-white/[0.08] dark:bg-white/[0.025]">
+                class="flex min-h-52 flex-col items-center justify-center rounded-xl border border-neutral-200 bg-white px-6 text-center dark:border-white/[0.08] dark:bg-white/[0.05]">
                 <x-reicon name="search" class="mb-3 size-6 text-neutral-300 dark:text-fg-faint" />
                 <p class="text-[13px] font-medium">No matching environments</p>
                 <p class="mt-1 text-[12px] text-neutral-500 dark:text-fg-dim">
diff --git a/resources/views/livewire/security/cloud-init-scripts.blade.php b/resources/views/livewire/security/cloud-init-scripts.blade.php
index 66690ace5f..0267d4358e 100644
--- a/resources/views/livewire/security/cloud-init-scripts.blade.php
+++ b/resources/views/livewire/security/cloud-init-scripts.blade.php
@@ -28,7 +28,7 @@
                     icon-name="file-content" size="sm" />
             @else
                 <div>
-                    <div class="grid grid-cols-[minmax(0,1fr)_12rem_1.75rem] items-center gap-3 border-b border-neutral-200 bg-neutral-50 px-4 py-2.5 text-[13px] font-medium text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.025] dark:text-fg-faint">
+                    <div class="grid grid-cols-[minmax(0,1fr)_12rem_1.75rem] items-center gap-3 border-b border-neutral-200 bg-neutral-50 px-4 py-2.5 text-[13px] font-medium text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.05] dark:text-fg-faint">
                         <div class="pl-11">Script</div>
                         <div>Last updated</div>
                         <div class="w-7"></div>
diff --git a/resources/views/livewire/security/cloud-provider-token-form.blade.php b/resources/views/livewire/security/cloud-provider-token-form.blade.php
index ad594ba6b4..271ad7367d 100644
--- a/resources/views/livewire/security/cloud-provider-token-form.blade.php
+++ b/resources/views/livewire/security/cloud-provider-token-form.blade.php
@@ -24,7 +24,7 @@
         @endif
 
         <div
-            class="rounded-lg border border-neutral-200 bg-neutral-50 p-3 text-[11px] leading-5 text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.025] dark:text-fg-dim">
+            class="rounded-lg border border-neutral-200 bg-neutral-50 p-3 text-[11px] leading-5 text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.05] dark:text-fg-dim">
             Create the token in the
             <a :href="providerConsoleUrl"
                 target="_blank" class="font-medium text-coollabs hover:underline dark:text-warning">
diff --git a/resources/views/livewire/security/cloud-provider-tokens.blade.php b/resources/views/livewire/security/cloud-provider-tokens.blade.php
index de17bbec43..2d87319c32 100644
--- a/resources/views/livewire/security/cloud-provider-tokens.blade.php
+++ b/resources/views/livewire/security/cloud-provider-tokens.blade.php
@@ -20,7 +20,7 @@
                 description="Add a provider token to provision new cloud servers." icon-name="keys" size="sm" />
         @else
             <div>
-                <div class="grid grid-cols-[minmax(0,1fr)_8rem_1.75rem] items-center gap-3 border-b border-neutral-200 bg-neutral-50 px-4 py-2.5 text-[13px] font-medium text-neutral-500 sm:grid-cols-[minmax(0,1fr)_8rem_minmax(0,1fr)_1.75rem] dark:border-white/[0.08] dark:bg-white/[0.025] dark:text-fg-faint">
+                <div class="grid grid-cols-[minmax(0,1fr)_8rem_1.75rem] items-center gap-3 border-b border-neutral-200 bg-neutral-50 px-4 py-2.5 text-[13px] font-medium text-neutral-500 sm:grid-cols-[minmax(0,1fr)_8rem_minmax(0,1fr)_1.75rem] dark:border-white/[0.08] dark:bg-white/[0.05] dark:text-fg-faint">
                     <div class="pl-11">Token</div>
                     <div class="text-center">Provider</div>
                     <div class="hidden sm:block">Description</div>
diff --git a/resources/views/livewire/security/private-key/index.blade.php b/resources/views/livewire/security/private-key/index.blade.php
index a5dda7ad9a..70b87a5845 100644
--- a/resources/views/livewire/security/private-key/index.blade.php
+++ b/resources/views/livewire/security/private-key/index.blade.php
@@ -68,7 +68,7 @@
             icon-name="keys" />
     @else
         <div>
-            <div class="grid grid-cols-[minmax(0,1fr)_7rem_1.75rem] items-center gap-3 border-b border-neutral-200 bg-neutral-50 px-4 py-2.5 text-[13px] font-medium text-neutral-500 sm:grid-cols-[minmax(0,1.2fr)_minmax(0,1fr)_7rem_1.75rem] dark:border-white/[0.08] dark:bg-white/[0.025] dark:text-fg-faint">
+            <div class="grid grid-cols-[minmax(0,1fr)_7rem_1.75rem] items-center gap-3 border-b border-neutral-200 bg-neutral-50 px-4 py-2.5 text-[13px] font-medium text-neutral-500 sm:grid-cols-[minmax(0,1.2fr)_minmax(0,1fr)_7rem_1.75rem] dark:border-white/[0.08] dark:bg-white/[0.05] dark:text-fg-faint">
                 <div class="pl-11">Private key</div>
                 <div class="hidden sm:block">Description</div>
                 <div class="text-center">Status</div>
@@ -115,7 +115,7 @@
                         title="You do not have permission to view this private key">
                         <div class="flex items-start gap-3">
                             <div
-                                class="flex size-8 shrink-0 items-center justify-center rounded-lg border border-neutral-200 bg-white text-neutral-400 dark:border-white/[0.08] dark:bg-white/[0.025] dark:text-fg-faint">
+                                class="flex size-8 shrink-0 items-center justify-center rounded-lg border border-neutral-200 bg-white text-neutral-400 dark:border-white/[0.08] dark:bg-white/[0.05] dark:text-fg-faint">
                                 <x-reicon name="keys" class="size-4" />
                             </div>
                             <div class="min-w-0 flex-1">
diff --git a/resources/views/livewire/server/create.blade.php b/resources/views/livewire/server/create.blade.php
index b61640fb69..d1530985e5 100644
--- a/resources/views/livewire/server/create.blade.php
+++ b/resources/views/livewire/server/create.blade.php
@@ -24,7 +24,7 @@
                 <div class="application-settings-section-body is-flush">
                     <div class="grid grid-cols-1 gap-3 p-3 sm:grid-cols-2 lg:grid-cols-4">
                         <a href="{{ route('server.create.type', ['type' => 'manual']) }}"
-                            class="group flex min-h-32 flex-col rounded-xl border border-neutral-200 bg-white p-3 shadow-sm transition-all hover:-translate-y-px hover:border-neutral-300 hover:no-underline hover:shadow-md dark:border-white/[0.08] dark:bg-white/[0.025] dark:hover:border-white/[0.14]"
+                            class="group flex min-h-32 flex-col rounded-xl border border-neutral-200 bg-white p-3 shadow-sm transition-all hover:-translate-y-px hover:border-neutral-300 hover:no-underline hover:shadow-md dark:border-white/[0.08] dark:bg-white/[0.05] dark:hover:border-white/[0.14]"
                             {{ wireNavigate() }}>
                             <div class="flex items-start">
                                 <span
@@ -52,7 +52,7 @@
                     <div class="application-settings-section-body is-flush">
                         <div class="grid grid-cols-1 gap-3 p-3 sm:grid-cols-2 lg:grid-cols-3">
                             <a href="{{ route('server.create.type', ['type' => 'hetzner']) }}"
-                                class="group flex min-h-32 flex-col rounded-xl border border-neutral-200 bg-white p-3 shadow-sm transition-all hover:-translate-y-px hover:border-neutral-300 hover:no-underline hover:shadow-md dark:border-white/[0.08] dark:bg-white/[0.025] dark:hover:border-white/[0.14]"
+                                class="group flex min-h-32 flex-col rounded-xl border border-neutral-200 bg-white p-3 shadow-sm transition-all hover:-translate-y-px hover:border-neutral-300 hover:no-underline hover:shadow-md dark:border-white/[0.08] dark:bg-white/[0.05] dark:hover:border-white/[0.14]"
                                 {{ wireNavigate() }}>
                                 <div class="flex items-start">
                                     <img src="{{ asset('svgs/hetzner.svg') }}" alt="Hetzner" class="size-8">
@@ -66,7 +66,7 @@
                             </a>
 
                             <a href="{{ route('server.create.type', ['type' => 'vultr']) }}"
-                                class="group flex min-h-32 flex-col rounded-xl border border-neutral-200 bg-white p-3 shadow-sm transition-all hover:-translate-y-px hover:border-neutral-300 hover:no-underline hover:shadow-md dark:border-white/[0.08] dark:bg-white/[0.025] dark:hover:border-white/[0.14]"
+                                class="group flex min-h-32 flex-col rounded-xl border border-neutral-200 bg-white p-3 shadow-sm transition-all hover:-translate-y-px hover:border-neutral-300 hover:no-underline hover:shadow-md dark:border-white/[0.08] dark:bg-white/[0.05] dark:hover:border-white/[0.14]"
                                 {{ wireNavigate() }}>
                                 <div class="flex items-start">
                                     <img src="https://www.vultr.com/media/logo_ondark.svg" alt="Vultr"
@@ -81,7 +81,7 @@
                             </a>
 
                             <a href="{{ route('server.create.type', ['type' => 'digital-ocean']) }}"
-                                class="group flex min-h-32 flex-col rounded-xl border border-neutral-200 bg-white p-3 shadow-sm transition-all hover:-translate-y-px hover:border-neutral-300 hover:no-underline hover:shadow-md dark:border-white/[0.08] dark:bg-white/[0.025] dark:hover:border-white/[0.14]"
+                                class="group flex min-h-32 flex-col rounded-xl border border-neutral-200 bg-white p-3 shadow-sm transition-all hover:-translate-y-px hover:border-neutral-300 hover:no-underline hover:shadow-md dark:border-white/[0.08] dark:bg-white/[0.05] dark:hover:border-white/[0.14]"
                                 {{ wireNavigate() }}>
                                 <div class="flex items-start">
                                     <x-digital-ocean-icon class="size-8" />
diff --git a/resources/views/livewire/server/index.blade.php b/resources/views/livewire/server/index.blade.php
index 112e052094..14de8dffab 100644
--- a/resources/views/livewire/server/index.blade.php
+++ b/resources/views/livewire/server/index.blade.php
@@ -134,7 +134,7 @@
                     <a x-cloak
                         x-show="filteredServers.some(server => server.uuid === @js($server->uuid))"
                         href="{{ $serverRow['href'] }}" {{ wireNavigate() }}
-                        class="group relative flex min-h-28 flex-col rounded-xl border border-neutral-200 bg-white p-3 shadow-sm transition-all hover:-translate-y-px hover:border-neutral-300 hover:no-underline hover:shadow-md dark:border-white/[0.08] dark:bg-white/[0.025] dark:hover:border-white/[0.14]">
+                        class="group relative flex min-h-28 flex-col rounded-xl border border-neutral-200 bg-white p-3 shadow-sm transition-all hover:-translate-y-px hover:border-neutral-300 hover:no-underline hover:shadow-md dark:border-white/[0.08] dark:bg-white/[0.05] dark:hover:border-white/[0.14]">
                         @if ($server->isMetricsEnabled())
                             <livewire:dashboard.server-metrics-chart :server="$server"
                                 :key="'server-index-metrics-'.$server->uuid" />
@@ -170,9 +170,9 @@
             </div>
 
             <div x-show="viewMode === 'table'"
-                class="overflow-x-auto rounded-xl border border-neutral-200 bg-white shadow-sm dark:border-white/[0.08] dark:bg-white/[0.025]">
+                class="overflow-x-auto rounded-xl border border-neutral-200 bg-white shadow-sm dark:border-white/[0.08] dark:bg-white/[0.05]">
                 <div
-                    class="grid min-w-[480px] grid-cols-[minmax(0,1fr)_9.5rem] border-b border-neutral-200 bg-neutral-50 px-4 py-2.5 text-[11px] font-medium text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.025] dark:text-fg-faint">
+                    class="grid min-w-[480px] grid-cols-[minmax(0,1fr)_9.5rem] border-b border-neutral-200 bg-neutral-50 px-4 py-2.5 text-[11px] font-medium text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.05] dark:text-fg-faint">
                     <div>Server</div>
                     <div>Status</div>
                 </div>
@@ -205,7 +205,7 @@
             </div>
 
             <div x-show="filteredServers.length === 0"
-                class="flex min-h-52 flex-col items-center justify-center rounded-xl border border-neutral-200 bg-white px-6 text-center dark:border-white/[0.08] dark:bg-white/[0.025]">
+                class="flex min-h-52 flex-col items-center justify-center rounded-xl border border-neutral-200 bg-white px-6 text-center dark:border-white/[0.08] dark:bg-white/[0.05]">
                 <x-reicon name="search" class="mb-3 size-6 text-neutral-300 dark:text-fg-faint" />
                 <p class="text-[13px] font-medium">No matching servers</p>
                 <p class="mt-1 text-[12px] text-neutral-500 dark:text-fg-dim">Try a different search.</p>
diff --git a/resources/views/livewire/server/resources.blade.php b/resources/views/livewire/server/resources.blade.php
index 9fb2ca2fcc..78ed0eb01a 100644
--- a/resources/views/livewire/server/resources.blade.php
+++ b/resources/views/livewire/server/resources.blade.php
@@ -30,9 +30,27 @@
                 </x-forms.button>
             </x-slot:actions>
 
+            <div class="border-b border-neutral-200 p-3 dark:border-white/[0.08]">
+                <div class="relative w-full max-w-sm">
+                    <x-reicon name="search"
+                        class="pointer-events-none absolute top-1/2 left-2.5 z-10 size-3.5 -translate-y-1/2 text-neutral-400 dark:text-fg-faint" />
+                    <input wire:model.live.debounce.300ms="search" type="search" placeholder="Search resources by name"
+                        aria-label="Search resources by name"
+                        class="h-8! w-full rounded-lg! border-neutral-200! bg-white! py-0! pr-8! pl-8! text-[12px]! shadow-none! placeholder:text-neutral-400 focus:border-accent! focus:ring-0! dark:border-white/[0.08]! dark:bg-white/[0.035]! dark:text-fg! dark:placeholder:text-fg-faint">
+                    <button type="button" wire:click="$set('search', '')" @class([
+                        'absolute top-1/2 right-2 flex size-5 -translate-y-1/2 items-center justify-center rounded text-neutral-400 transition-colors hover:bg-neutral-100 hover:text-black dark:text-fg-faint dark:hover:bg-white/[0.07] dark:hover:text-fg',
+                        'hidden' => blank($search),
+                    ]) aria-label="Clear search">
+                        <x-reicon name="x" class="size-3" />
+                    </button>
+                </div>
+            </div>
+
+            <div class="relative">
+            <div class="transition-all" wire:loading.class="pointer-events-none opacity-40 blur-[2px]"
+                wire:loading.attr="inert" wire:target="search">
             @if ($activeTab === 'managed')
-                @php($managedResources = $server->definedResources()->sortBy('name', SORT_NATURAL))
-                @if ($managedResources->count() > 0)
+                @if ($resources->total() > 0)
                     <div class="data-table">
                         <div class="data-table-header server-resources-managed-table-grid">
                             <span>Name</span>
@@ -41,9 +59,9 @@
                             <span>Type</span>
                             <span>Status</span>
                         </div>
-                        @foreach ($managedResources as $resource)
+                        @foreach ($resources as $resource)
                             @php($resourceStatus = (string) data_get($resource, 'status', 'unknown'))
-                            <div
+                            <div wire:key="managed-{{ $resource->type() }}-{{ $resource->uuid }}"
                                 class="data-table-row server-resources-managed-table-grid border-b border-neutral-200 last:border-b-0 dark:border-white/[0.08]">
                                 <div class="min-w-0">
                                     <a class="block max-w-full truncate text-[12px] font-medium text-neutral-950 hover:underline dark:text-fg"
@@ -72,22 +90,16 @@
                                 </div>
                             </div>
                         @endforeach
-                        <div
-                            class="flex min-h-11 items-center border-t border-neutral-200 px-4 text-[11px] text-neutral-500 dark:border-white/[0.08] dark:text-fg-faint">
-                            {{ $managedResources->count() }}
-                            {{ Str::plural('managed resource', $managedResources->count()) }}
-                        </div>
                     </div>
                 @else
                     <div class="p-6">
-                        <x-empty size="sm" title="No managed resources"
-                            description="Resources assigned to this server will appear here."
+                        <x-empty size="sm" :title="trim($search) !== '' ? 'No matching resources' : 'No managed resources'"
+                            :description="trim($search) !== '' ? 'Try another name or clear the search.' : 'Resources assigned to this server will appear here.'"
                             icon-name="projects" />
                     </div>
                 @endif
             @else
-                @if (count($unmanagedContainers) > 0)
-                    @php($sortedUnmanagedContainers = collect($unmanagedContainers)->sortBy('name', SORT_NATURAL))
+                @if ($resources->total() > 0)
                     <div class="data-table">
                         <div class="data-table-header server-resources-unmanaged-table-grid">
                             <span>Name</span>
@@ -95,9 +107,9 @@
                             <span>Status</span>
                             <span>Actions</span>
                         </div>
-                        @foreach ($sortedUnmanagedContainers as $resource)
+                        @foreach ($resources as $resource)
                             @php($containerState = (string) data_get($resource, 'State', 'unknown'))
-                            <div
+                            <div wire:key="unmanaged-{{ data_get($resource, 'ID') }}"
                                 class="data-table-row server-resources-unmanaged-table-grid border-b border-neutral-200 last:border-b-0 dark:border-white/[0.08]">
                                 <div class="min-w-0 truncate text-[12px] font-medium text-neutral-950 dark:text-fg">
                                     {{ data_get($resource, 'Names') }}
@@ -139,20 +151,28 @@
                                 </div>
                             </div>
                         @endforeach
-                        <div
-                            class="flex min-h-11 items-center border-t border-neutral-200 px-4 text-[11px] text-neutral-500 dark:border-white/[0.08] dark:text-fg-faint">
-                            {{ $sortedUnmanagedContainers->count() }}
-                            {{ Str::plural('unmanaged container', $sortedUnmanagedContainers->count()) }}
-                        </div>
                     </div>
                 @else
                     <div class="p-6">
-                        <x-empty size="sm" title="No unmanaged containers"
-                            description="All detected Docker containers are managed by Coolify."
+                        <x-empty size="sm" :title="trim($search) !== '' ? 'No matching containers' : 'No unmanaged containers'"
+                            :description="trim($search) !== '' ? 'Try another name or clear the search.' : 'All detected Docker containers are managed by Coolify.'"
                             icon-name="servers" />
                     </div>
                 @endif
             @endif
+            @if ($resources->total() > 0)
+                <x-table-pagination :from="$resources->firstItem()" :to="$resources->lastItem()"
+                    :total="$resources->total()" :current-page="$resources->currentPage()"
+                    :last-page="$resources->lastPage()" wire-target="previousPage,nextPage,perPage"
+                    previous-action="previousPage" next-action="nextPage">
+                    <x-slot:pageSize>
+                        <x-page-size-select model="perPage" livewire storage-key="coolify.page-size.server-resources" />
+                    </x-slot:pageSize>
+                </x-table-pagination>
+            @endif
+            </div>
+                <x-table.loading target="search" text="Searching resources..." />
+            </div>
         </x-application.settings-section>
         </div>
     </div>
diff --git a/resources/views/livewire/server/sentinel/logs.blade.php b/resources/views/livewire/server/sentinel/logs.blade.php
index 455bb55bb2..37f8367fd1 100644
--- a/resources/views/livewire/server/sentinel/logs.blade.php
+++ b/resources/views/livewire/server/sentinel/logs.blade.php
@@ -10,15 +10,27 @@
             <x-application.settings-section title="Sentinel logs"
                 helper="Search, filter, follow, copy, or download recent output from the Sentinel container."
                 flush class="logs-settings-section">
-                <x-slot:actions>
-                    <x-status-badge :status="$server->isSentinelLive() ? 'In sync' : 'Out of sync'"
-                        :type="$server->isSentinelLive() ? 'success' : 'warning'"
-                        class="logs-section-status-badge" />
-                </x-slot:actions>
-                <div class="settings-log-panel">
-                    <livewire:project.shared.get-logs :server="$server" container="coolify-sentinel"
-                        displayName="Sentinel" :collapsible="false" />
-                </div>
+                @if ($server->isSentinelEnabled())
+                    <x-slot:actions>
+                        <x-status-badge :status="$server->isSentinelLive() ? 'In sync' : 'Out of sync'"
+                            :type="$server->isSentinelLive() ? 'success' : 'warning'"
+                            class="logs-section-status-badge" />
+                    </x-slot:actions>
+                    <div class="settings-log-panel">
+                        <livewire:project.shared.get-logs :server="$server" container="coolify-sentinel"
+                            displayName="Sentinel" :collapsible="false" />
+                    </div>
+                @else
+                    <x-slot:actions>
+                        <x-forms.button canGate="manageSentinel" :canResource="$server" isHighlighted
+                            wire:click="enableSentinel">
+                            Enable Sentinel
+                        </x-forms.button>
+                    </x-slot:actions>
+                    <x-empty size="sm" title="Sentinel is disabled"
+                        description="Enable Sentinel to view its logs."
+                        icon-name="dashboard" />
+                @endif
             </x-application.settings-section>
         </div>
     </div>
diff --git a/resources/views/livewire/server/show.blade.php b/resources/views/livewire/server/show.blade.php
index 1ee4279bd4..604041c770 100644
--- a/resources/views/livewire/server/show.blade.php
+++ b/resources/views/livewire/server/show.blade.php
@@ -146,7 +146,7 @@
                                         Link provider
                                     </button>
                                     <div x-cloak x-show="open" x-transition.origin.top.right
-                                        class="absolute top-9 right-0 z-50 w-56 rounded-lg border border-neutral-200 bg-white p-1 shadow-modal dark:border-white/[0.1] dark:bg-raised">
+                                        class="absolute top-9 right-0 z-50 w-56 rounded-lg border border-neutral-200 bg-white p-1 shadow-dropdown dark:border-white/[0.1] dark:bg-raised">
                                         @if (!$server->hetzner_server_id && $availableHetznerTokens->isNotEmpty())
                                             <x-server.provider-link-modal :server="$server" provider="hetzner"
                                                 providerLabel="Hetzner" tokenModel="selectedHetznerTokenId"
diff --git a/resources/views/livewire/server/validate-and-install.blade.php b/resources/views/livewire/server/validate-and-install.blade.php
index 5117bcd152..02aa4d34f3 100644
--- a/resources/views/livewire/server/validate-and-install.blade.php
+++ b/resources/views/livewire/server/validate-and-install.blade.php
@@ -75,7 +75,7 @@
 <div class="flex h-full min-h-0 flex-col gap-4 overflow-y-auto scrollbar">
     @if ($ask)
         <div
-            class="rounded-[10px] border border-neutral-200 bg-neutral-50 px-4 py-3 text-[13px] leading-5 text-neutral-600 dark:border-white/[0.08] dark:bg-white/[0.025] dark:text-fg-dim">
+            class="rounded-[10px] border border-neutral-200 bg-neutral-50 px-4 py-3 text-[13px] leading-5 text-neutral-600 dark:border-white/[0.08] dark:bg-white/[0.05] dark:text-fg-dim">
             This will revalidate the server, install or update Docker Engine, Docker Compose, and related
             configuration. Docker Engine will restart, so running containers may be briefly unreachable.
         </div>
diff --git a/resources/views/livewire/settings/advanced.blade.php b/resources/views/livewire/settings/advanced.blade.php
index 94927ba257..4c11cb41d4 100644
--- a/resources/views/livewire/settings/advanced.blade.php
+++ b/resources/views/livewire/settings/advanced.blade.php
@@ -9,7 +9,7 @@
                  listboxes (API, MCP, telemetry, …) update the snapshot on the server
                  immediately; without wire:target they briefly flash this bar. --}}
             <x-unsaved-bar action="submit"
-                targets="custom_dns_servers,allowed_ips,webhook_allowed_internal_hosts,webhook_allow_localhost,domain_connect_private_key" />
+                targets="custom_dns_servers,allowed_ips,webhook_allowed_internal_hosts,webhook_allow_localhost,domain_connect_private_key,image_cdn_url" />
 
             <x-application.settings-section id="access-section" title="Access">
                 <div class="grid gap-4 lg:grid-cols-2">
@@ -144,9 +144,11 @@
 
             <x-application.settings-section id="avatar-storage-section" title="Image storage"
                 helper="Choose where compressed profile pictures and project icons are stored. Use S3 for multi-instance or cloud deployments so every application replica can access the same files.">
-                <div class="max-w-md">
+                <div class="flex max-w-md flex-col gap-4">
                     <x-forms.listbox id="avatar_storage" label="Storage destination" onChange="instantSave"
                         :options="$avatar_storage_options" />
+                    <x-forms.input id="image_cdn_url" label="Image CDN URL"
+                        helper="Optional public CDN URL for profile pictures and project icons stored on S3. Leave empty to use the S3 endpoint." placeholder="https://images.example.com" />
                 </div>
                 @if (count($avatar_storage_options) === 1)
                     <x-callout type="info" title="No usable S3 storage configured" class="mt-4">
diff --git a/resources/views/livewire/shared-variables/environment/index.blade.php b/resources/views/livewire/shared-variables/environment/index.blade.php
index 4a6d2244aa..15c6dd461d 100644
--- a/resources/views/livewire/shared-variables/environment/index.blade.php
+++ b/resources/views/livewire/shared-variables/environment/index.blade.php
@@ -22,17 +22,14 @@
                             $project->description,
                             ...$project->environments->flatMap(fn ($environment) => [$environment->name, $environment->description])->all(),
                         ]))">
-                            <div class="mb-3">
-                                <h2 class="text-[14px]! leading-5! font-semibold! text-black dark:text-fg">{{ $project->name }}</h2>
-                                <p class="mt-0.5 text-[11px] text-neutral-500 dark:text-fg-faint">{{ $project->description ?: 'Project environments' }}</p>
-                            </div>
+                            <x-section-heading :title="$project->name" :subtitle="$project->description ?: 'Project environments'" />
                             @if ($project->environments->isEmpty())
                                 <x-empty title="No environments in this project." size="sm" />
                             @else
                                 <div class="grid grid-cols-1 gap-3 sm:grid-cols-2 lg:grid-cols-4">
                                     @foreach ($project->environments as $environment)
                                         <a x-show="matches(@js([$environment->name, $environment->description, $project->name]))"
-                                            class="group flex min-h-24 flex-col rounded-xl border border-neutral-200 bg-white p-3 shadow-sm transition-all hover:-translate-y-px hover:border-neutral-300 hover:no-underline hover:shadow-md dark:border-white/[0.08] dark:bg-white/[0.025] dark:hover:border-white/[0.14]"
+                                            class="group flex min-h-24 flex-col rounded-xl border border-neutral-200 bg-white p-3 shadow-sm transition-all hover:-translate-y-px hover:border-neutral-300 hover:no-underline hover:shadow-md dark:border-white/[0.08] dark:bg-white/[0.05] dark:hover:border-white/[0.14]"
                                             href="{{ route('shared-variables.environment.show', ['project_uuid' => $project->uuid, 'environment_uuid' => $environment->uuid]) }}" {{ wireNavigate() }}>
                                             <div class="flex items-start gap-3">
                                                 <div class="flex size-8 shrink-0 items-center justify-center rounded-lg border border-neutral-200 bg-neutral-50 text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.04] dark:text-fg-dim"><x-reicon name="layers" class="size-4" /></div>
@@ -46,7 +43,7 @@
                     @endforeach
                 </div>
 
-                <div x-show="viewMode === 'list'" class="overflow-hidden rounded-xl border border-neutral-200 bg-white shadow-sm dark:border-white/[0.08] dark:bg-white/[0.025]">
+                <div x-show="viewMode === 'list'" class="overflow-hidden rounded-xl border border-neutral-200 bg-white shadow-sm dark:border-white/[0.08] dark:bg-white/[0.05]">
                     @foreach ($projects as $project)
                         @foreach ($project->environments as $environment)
                             <a x-show="matches(@js([$environment->name, $environment->description, $project->name]))"
diff --git a/resources/views/livewire/shared-variables/index.blade.php b/resources/views/livewire/shared-variables/index.blade.php
index 0565e40273..4cf74d6c8a 100644
--- a/resources/views/livewire/shared-variables/index.blade.php
+++ b/resources/views/livewire/shared-variables/index.blade.php
@@ -7,7 +7,7 @@
 
     <div class="w-full">
     <div class="grid grid-cols-1 gap-3 sm:grid-cols-2 lg:grid-cols-4">
-        <a class="group flex min-h-32 flex-col rounded-xl border border-neutral-200 bg-white p-3 shadow-sm transition-all hover:-translate-y-px hover:border-neutral-300 hover:no-underline hover:shadow-md dark:border-white/[0.08] dark:bg-white/[0.025] dark:hover:border-white/[0.14]"
+        <a class="group flex min-h-32 flex-col rounded-xl border border-neutral-200 bg-white p-3 shadow-sm transition-all hover:-translate-y-px hover:border-neutral-300 hover:no-underline hover:shadow-md dark:border-white/[0.08] dark:bg-white/[0.05] dark:hover:border-white/[0.14]"
             href="{{ route('shared-variables.team.index') }}" {{ wireNavigate() }}>
             <div
                 class="flex size-8 items-center justify-center rounded-lg border border-neutral-200 bg-neutral-50 text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.04] dark:text-fg-dim">
@@ -21,7 +21,7 @@
             </div>
         </a>
 
-        <a class="group flex min-h-32 flex-col rounded-xl border border-neutral-200 bg-white p-3 shadow-sm transition-all hover:-translate-y-px hover:border-neutral-300 hover:no-underline hover:shadow-md dark:border-white/[0.08] dark:bg-white/[0.025] dark:hover:border-white/[0.14]"
+        <a class="group flex min-h-32 flex-col rounded-xl border border-neutral-200 bg-white p-3 shadow-sm transition-all hover:-translate-y-px hover:border-neutral-300 hover:no-underline hover:shadow-md dark:border-white/[0.08] dark:bg-white/[0.05] dark:hover:border-white/[0.14]"
             href="{{ route('shared-variables.project.index') }}" {{ wireNavigate() }}>
             <div
                 class="flex size-8 items-center justify-center rounded-lg border border-neutral-200 bg-neutral-50 text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.04] dark:text-fg-dim">
@@ -35,7 +35,7 @@
             </div>
         </a>
 
-        <a class="group flex min-h-32 flex-col rounded-xl border border-neutral-200 bg-white p-3 shadow-sm transition-all hover:-translate-y-px hover:border-neutral-300 hover:no-underline hover:shadow-md dark:border-white/[0.08] dark:bg-white/[0.025] dark:hover:border-white/[0.14]"
+        <a class="group flex min-h-32 flex-col rounded-xl border border-neutral-200 bg-white p-3 shadow-sm transition-all hover:-translate-y-px hover:border-neutral-300 hover:no-underline hover:shadow-md dark:border-white/[0.08] dark:bg-white/[0.05] dark:hover:border-white/[0.14]"
             href="{{ route('shared-variables.environment.index') }}" {{ wireNavigate() }}>
             <div
                 class="flex size-8 items-center justify-center rounded-lg border border-neutral-200 bg-neutral-50 text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.04] dark:text-fg-dim">
@@ -49,7 +49,7 @@
             </div>
         </a>
 
-        <a class="group flex min-h-32 flex-col rounded-xl border border-neutral-200 bg-white p-3 shadow-sm transition-all hover:-translate-y-px hover:border-neutral-300 hover:no-underline hover:shadow-md dark:border-white/[0.08] dark:bg-white/[0.025] dark:hover:border-white/[0.14]"
+        <a class="group flex min-h-32 flex-col rounded-xl border border-neutral-200 bg-white p-3 shadow-sm transition-all hover:-translate-y-px hover:border-neutral-300 hover:no-underline hover:shadow-md dark:border-white/[0.08] dark:bg-white/[0.05] dark:hover:border-white/[0.14]"
             href="{{ route('shared-variables.server.index') }}" {{ wireNavigate() }}>
             <div
                 class="flex size-8 items-center justify-center rounded-lg border border-neutral-200 bg-neutral-50 text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.04] dark:text-fg-dim">
diff --git a/resources/views/livewire/shared-variables/project/index.blade.php b/resources/views/livewire/shared-variables/project/index.blade.php
index 63e4f45731..71fd497b66 100644
--- a/resources/views/livewire/shared-variables/project/index.blade.php
+++ b/resources/views/livewire/shared-variables/project/index.blade.php
@@ -19,7 +19,7 @@
                 <div x-cloak x-show="viewMode === 'grid'" class="grid grid-cols-1 gap-3 sm:grid-cols-2 lg:grid-cols-4">
                     @foreach ($projects as $project)
                         <a x-show="matches(@js([$project->name, $project->description]))"
-                            class="group flex min-h-28 flex-col rounded-xl border border-neutral-200 bg-white p-3 shadow-sm transition-all hover:-translate-y-px hover:border-neutral-300 hover:no-underline hover:shadow-md dark:border-white/[0.08] dark:bg-white/[0.025] dark:hover:border-white/[0.14]"
+                            class="group flex min-h-28 flex-col rounded-xl border border-neutral-200 bg-white p-3 shadow-sm transition-all hover:-translate-y-px hover:border-neutral-300 hover:no-underline hover:shadow-md dark:border-white/[0.08] dark:bg-white/[0.05] dark:hover:border-white/[0.14]"
                             href="{{ route('shared-variables.project.show', ['project_uuid' => $project->uuid]) }}" {{ wireNavigate() }}>
                             <div class="flex items-start gap-3">
                                 <div class="flex size-8 shrink-0 items-center justify-center rounded-lg border border-neutral-200 bg-neutral-50 text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.04] dark:text-fg-dim">
@@ -43,7 +43,7 @@
                     @endforeach
                 </div>
 
-                <div x-show="viewMode === 'list'" class="overflow-hidden rounded-xl border border-neutral-200 bg-white shadow-sm dark:border-white/[0.08] dark:bg-white/[0.025]">
+                <div x-show="viewMode === 'list'" class="overflow-hidden rounded-xl border border-neutral-200 bg-white shadow-sm dark:border-white/[0.08] dark:bg-white/[0.05]">
                     @foreach ($projects as $project)
                         <a x-show="matches(@js([$project->name, $project->description]))"
                             href="{{ route('shared-variables.project.show', ['project_uuid' => $project->uuid]) }}" {{ wireNavigate() }}
diff --git a/resources/views/livewire/shared-variables/server/index.blade.php b/resources/views/livewire/shared-variables/server/index.blade.php
index 8c58792af7..ed92da40f3 100644
--- a/resources/views/livewire/shared-variables/server/index.blade.php
+++ b/resources/views/livewire/shared-variables/server/index.blade.php
@@ -18,7 +18,7 @@
                 <div x-cloak x-show="viewMode === 'grid'" class="grid grid-cols-1 gap-3 sm:grid-cols-2 lg:grid-cols-4">
                     @foreach ($servers as $server)
                         <a x-show="matches(@js([$server->name, $server->description, $server->ip]))"
-                            class="group flex min-h-28 flex-col rounded-xl border border-neutral-200 bg-white p-3 shadow-sm transition-all hover:-translate-y-px hover:border-neutral-300 hover:no-underline hover:shadow-md dark:border-white/[0.08] dark:bg-white/[0.025] dark:hover:border-white/[0.14]"
+                            class="group flex min-h-28 flex-col rounded-xl border border-neutral-200 bg-white p-3 shadow-sm transition-all hover:-translate-y-px hover:border-neutral-300 hover:no-underline hover:shadow-md dark:border-white/[0.08] dark:bg-white/[0.05] dark:hover:border-white/[0.14]"
                             href="{{ route('shared-variables.server.show', ['server_uuid' => $server->uuid]) }}" {{ wireNavigate() }}>
                             <div class="flex items-start gap-3">
                                 <div class="flex size-8 shrink-0 items-center justify-center rounded-lg border border-neutral-200 bg-neutral-50 text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.04] dark:text-fg-dim"><x-reicon name="servers" class="size-4" /></div>
@@ -29,7 +29,7 @@
                     @endforeach
                 </div>
 
-                <div x-show="viewMode === 'list'" class="overflow-hidden rounded-xl border border-neutral-200 bg-white shadow-sm dark:border-white/[0.08] dark:bg-white/[0.025]">
+                <div x-show="viewMode === 'list'" class="overflow-hidden rounded-xl border border-neutral-200 bg-white shadow-sm dark:border-white/[0.08] dark:bg-white/[0.05]">
                     @foreach ($servers as $server)
                         <a x-show="matches(@js([$server->name, $server->description, $server->ip]))"
                             href="{{ route('shared-variables.server.show', ['server_uuid' => $server->uuid]) }}" {{ wireNavigate() }}
diff --git a/resources/views/livewire/shared-variables/server/show.blade.php b/resources/views/livewire/shared-variables/server/show.blade.php
index 4bba5eb064..445b6899e9 100644
--- a/resources/views/livewire/shared-variables/server/show.blade.php
+++ b/resources/views/livewire/shared-variables/server/show.blade.php
@@ -4,7 +4,8 @@
     </x-slot>
 
     <x-shared-variables.editor :resource="$server"
-        :variables="$server->environment_variables->whereNotIn('key', ['COOLIFY_SERVER_UUID', 'COOLIFY_SERVER_NAME'])"
+        :variables="$server->environment_variables"
+        :readOnlyKeys="['COOLIFY_SERVER_UUID', 'COOLIFY_SERVER_NAME']"
         type="server" title="{{ $server->name }}"
         :view="$view" variablesLabel="Server shared variables" />
 </div>
diff --git a/resources/views/livewire/shared/list-search-empty.blade.php b/resources/views/livewire/shared/list-search-empty.blade.php
index 9047394834..a74cf3a49a 100644
--- a/resources/views/livewire/shared/list-search-empty.blade.php
+++ b/resources/views/livewire/shared/list-search-empty.blade.php
@@ -1,4 +1,4 @@
-<div x-show="filteredItems.length === 0" class="flex min-h-52 flex-col items-center justify-center rounded-xl border border-neutral-200 bg-white px-6 text-center dark:border-white/[0.08] dark:bg-white/[0.025]">
+<div x-show="filteredItems.length === 0" class="flex min-h-52 flex-col items-center justify-center rounded-xl border border-neutral-200 bg-white px-6 text-center dark:border-white/[0.08] dark:bg-white/[0.05]">
     <x-reicon name="search" class="mb-3 size-6 text-neutral-300 dark:text-fg-faint" />
     <p class="text-[13px] font-medium">No matching {{ $label }}</p>
     <p class="mt-1 text-[12px] text-neutral-500 dark:text-fg-dim">Try a different search.</p>
diff --git a/resources/views/livewire/source/github/change.blade.php b/resources/views/livewire/source/github/change.blade.php
index 2730c19a97..ade5b53b1d 100644
--- a/resources/views/livewire/source/github/change.blade.php
+++ b/resources/views/livewire/source/github/change.blade.php
@@ -200,7 +200,7 @@
                                                         shortConfirmationLabel="GitHub App Name" :confirmWithPassword="false"
                                                         step2ButtonText="Permanently Delete" />
                                                 @else
-                                                    <x-forms.button disabled tooltip="You do not have permission to delete this GitHub App.">
+                                                    <x-forms.button isError disabled tooltip="You do not have permission to delete this GitHub App.">
                                                         Delete
                                                     </x-forms.button>
                                                 @endcan
@@ -300,7 +300,7 @@
                             @endif
 
                             <div
-                                class="rounded-lg border border-neutral-200 bg-neutral-50 p-3 text-[12px] leading-5 text-neutral-600 dark:border-white/[0.08] dark:bg-white/[0.025] dark:text-fg-dim">
+                                class="rounded-lg border border-neutral-200 bg-neutral-50 p-3 text-[12px] leading-5 text-neutral-600 dark:border-white/[0.08] dark:bg-white/[0.05] dark:text-fg-dim">
                                 <p class="font-medium text-black dark:text-fg">Mandatory permissions</p>
                                 <p class="mt-1">Contents: read · Metadata: read · Email: read</p>
                             </div>
diff --git a/resources/views/livewire/source/github/create.blade.php b/resources/views/livewire/source/github/create.blade.php
index 91d58564de..50922a5f2e 100644
--- a/resources/views/livewire/source/github/create.blade.php
+++ b/resources/views/livewire/source/github/create.blade.php
@@ -36,7 +36,7 @@
                     <polyline points="6 9 12 15 18 9"></polyline>
                 </svg>
             </button>
-            <div x-cloak x-show="open" x-collapse class="border-t border-neutral-200 px-3 py-3 dark:border-white/[0.08]">
+            <div x-cloak x-show="open" x-collapse.duration.200ms class="border-t border-neutral-200 px-3 py-3 dark:border-white/[0.08]">
                 <div class="grid gap-4 sm:grid-cols-2">
                     <x-forms.input id="html_url" label="HTML URL" required
                         helper="For GitHub Enterprise, enter your instance URL (e.g. https://github.example.com)." />
diff --git a/resources/views/livewire/source/github/resources.blade.php b/resources/views/livewire/source/github/resources.blade.php
index d071aa1e06..56f72f8c69 100644
--- a/resources/views/livewire/source/github/resources.blade.php
+++ b/resources/views/livewire/source/github/resources.blade.php
@@ -17,7 +17,7 @@
                         </div>
                         <div class="overflow-x-auto">
                             <div
-                                class="grid min-w-[680px] grid-cols-[minmax(10rem,.8fr)_minmax(10rem,.8fr)_minmax(12rem,1fr)_8rem] border-b border-neutral-200 bg-neutral-50 px-4 py-2.5 text-[11px] font-medium text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.025] dark:text-fg-faint">
+                                class="grid min-w-[680px] grid-cols-[minmax(10rem,.8fr)_minmax(10rem,.8fr)_minmax(12rem,1fr)_8rem] border-b border-neutral-200 bg-neutral-50 px-4 py-2.5 text-[11px] font-medium text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.05] dark:text-fg-faint">
                                 <div>Project</div>
                                 <div>Environment</div>
                                 <div>Resource</div>
diff --git a/resources/views/livewire/source/gitlab/change.blade.php b/resources/views/livewire/source/gitlab/change.blade.php
index 5629e1e364..03fec74e32 100644
--- a/resources/views/livewire/source/gitlab/change.blade.php
+++ b/resources/views/livewire/source/gitlab/change.blade.php
@@ -124,7 +124,7 @@
                     </div>
                     <div class="overflow-x-auto">
                         <div
-                            class="grid min-w-[680px] grid-cols-[minmax(10rem,.8fr)_minmax(10rem,.8fr)_minmax(12rem,1fr)_8rem] border-b border-neutral-200 bg-neutral-50 px-4 py-2.5 text-[11px] font-medium text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.025] dark:text-fg-faint">
+                            class="grid min-w-[680px] grid-cols-[minmax(10rem,.8fr)_minmax(10rem,.8fr)_minmax(12rem,1fr)_8rem] border-b border-neutral-200 bg-neutral-50 px-4 py-2.5 text-[11px] font-medium text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.05] dark:text-fg-faint">
                             <div>Project</div>
                             <div>Environment</div>
                             <div>Resource</div>
@@ -275,7 +275,7 @@
                                 <polyline points="6 9 12 15 18 9"></polyline>
                             </svg>
                         </button>
-                        <div x-cloak x-show="open" x-collapse
+                        <div x-cloak x-show="open" x-collapse.duration.200ms
                             class="mt-3 grid gap-4 rounded-lg border border-neutral-200 p-3 lg:grid-cols-2 dark:border-white/[0.08]">
                             <x-forms.input id="htmlUrl" label="GitLab URL"
                                 helper="Only change this for self-hosted GitLab (e.g. https://gitlab.example.com)." />
diff --git a/resources/views/livewire/source/gitlab/create.blade.php b/resources/views/livewire/source/gitlab/create.blade.php
index d0fe424064..bac16db248 100644
--- a/resources/views/livewire/source/gitlab/create.blade.php
+++ b/resources/views/livewire/source/gitlab/create.blade.php
@@ -36,7 +36,7 @@
                     <polyline points="6 9 12 15 18 9"></polyline>
                 </svg>
             </button>
-            <div x-cloak x-show="open" x-collapse class="border-t border-neutral-200 px-3 py-3 dark:border-white/[0.08]">
+            <div x-cloak x-show="open" x-collapse.duration.200ms class="border-t border-neutral-200 px-3 py-3 dark:border-white/[0.08]">
                 <div class="grid gap-4 sm:grid-cols-2">
                     <x-forms.input id="html_url" label="GitLab URL" required
                         helper="For self-hosted GitLab, enter your instance URL (e.g. https://gitlab.example.com)." />
diff --git a/resources/views/livewire/storage/index.blade.php b/resources/views/livewire/storage/index.blade.php
index 7d10a0b0d6..30f492705e 100644
--- a/resources/views/livewire/storage/index.blade.php
+++ b/resources/views/livewire/storage/index.blade.php
@@ -48,7 +48,7 @@
         <div x-cloak x-show="viewMode === 'grid'" class="grid grid-cols-1 gap-3 sm:grid-cols-2 lg:grid-cols-4">
             @foreach ($s3 as $storage)
                 <a x-show="matches(@js([$storage->name, $storage->description ?: 'S3-compatible storage', $storage->is_usable ? 'Connected' : 'Not usable']))" {{ wireNavigate() }} href="/storages/{{ $storage->uuid }}"
-                    class="group flex min-h-28 flex-col rounded-xl border border-neutral-200 bg-white p-3 shadow-sm transition-all hover:-translate-y-px hover:border-neutral-300 hover:no-underline hover:shadow-md dark:border-white/[0.08] dark:bg-white/[0.025] dark:hover:border-white/[0.14]">
+                    class="group flex min-h-28 flex-col rounded-xl border border-neutral-200 bg-white p-3 shadow-sm transition-all hover:-translate-y-px hover:border-neutral-300 hover:no-underline hover:shadow-md dark:border-white/[0.08] dark:bg-white/[0.05] dark:hover:border-white/[0.14]">
                     <div class="flex items-start gap-3">
                         <div
                             class="flex size-8 shrink-0 items-center justify-center rounded-lg border border-neutral-200 bg-neutral-50 text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.04] dark:text-fg-dim">
@@ -74,8 +74,8 @@
                 </a>
             @endforeach
         </div>
-        <div x-show="viewMode === 'table'" class="overflow-x-auto rounded-xl border border-neutral-200 bg-white shadow-sm dark:border-white/[0.08] dark:bg-white/[0.025]">
-            <div class="grid min-w-[620px] grid-cols-[minmax(0,1fr)_minmax(10rem,.8fr)_9rem] border-b border-neutral-200 bg-neutral-50 px-4 py-2.5 text-[11px] font-medium text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.025] dark:text-fg-faint"><div>Storage</div><div>Description</div><div>Status</div></div>
+        <div x-show="viewMode === 'table'" class="overflow-x-auto rounded-xl border border-neutral-200 bg-white shadow-sm dark:border-white/[0.08] dark:bg-white/[0.05]">
+            <div class="grid min-w-[620px] grid-cols-[minmax(0,1fr)_minmax(10rem,.8fr)_9rem] border-b border-neutral-200 bg-neutral-50 px-4 py-2.5 text-[11px] font-medium text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.05] dark:text-fg-faint"><div>Storage</div><div>Description</div><div>Status</div></div>
             @foreach ($s3 as $storage)
                 <a x-show="matches(@js([$storage->name, $storage->description ?: 'S3-compatible storage', $storage->is_usable ? 'Connected' : 'Not usable']))" {{ wireNavigate() }} href="/storages/{{ $storage->uuid }}" class="grid min-h-14 min-w-[620px] grid-cols-[minmax(0,1fr)_minmax(10rem,.8fr)_9rem] items-center border-b border-neutral-200 px-4 py-2.5 text-[12px] transition-colors last:border-b-0 hover:bg-neutral-50 hover:no-underline dark:border-white/[0.07] dark:hover:bg-white/[0.025]">
                     <div class="truncate font-semibold text-black dark:text-fg">{{ $storage->name }}</div>
diff --git a/resources/views/livewire/storage/resources.blade.php b/resources/views/livewire/storage/resources.blade.php
index 3c2fedd319..cb4b7b8ced 100644
--- a/resources/views/livewire/storage/resources.blade.php
+++ b/resources/views/livewire/storage/resources.blade.php
@@ -17,7 +17,7 @@
 
             <div class="overflow-x-auto">
                 <div
-                    class="grid min-w-[780px] grid-cols-[minmax(12rem,1fr)_9rem_7rem_minmax(15rem,1.2fr)] border-b border-neutral-200 bg-neutral-50 px-4 py-2.5 text-[11px] font-medium text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.025] dark:text-fg-faint">
+                    class="grid min-w-[780px] grid-cols-[minmax(12rem,1fr)_9rem_7rem_minmax(15rem,1.2fr)] border-b border-neutral-200 bg-neutral-50 px-4 py-2.5 text-[11px] font-medium text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.05] dark:text-fg-faint">
                     <div>Backup target</div>
                     <div>Frequency</div>
                     <div>Status</div>
diff --git a/resources/views/livewire/storage/show.blade.php b/resources/views/livewire/storage/show.blade.php
index c74938a4d3..72e03d7bf7 100644
--- a/resources/views/livewire/storage/show.blade.php
+++ b/resources/views/livewire/storage/show.blade.php
@@ -102,7 +102,7 @@
                                                     shortConfirmationLabel="Storage Name" :confirmWithPassword="false"
                                                     step2ButtonText="Permanently Delete" />
                                             @else
-                                                <x-forms.button disabled tooltip="You do not have permission to delete this storage.">
+                                                <x-forms.button isError disabled tooltip="You do not have permission to delete this storage.">
                                                     Delete
                                                 </x-forms.button>
                                             @endcan
diff --git a/resources/views/livewire/subscription/pricing-plans.blade.php b/resources/views/livewire/subscription/pricing-plans.blade.php
index f1823fd6e2..a1674b5a59 100644
--- a/resources/views/livewire/subscription/pricing-plans.blade.php
+++ b/resources/views/livewire/subscription/pricing-plans.blade.php
@@ -23,7 +23,7 @@
 
         <div class="grid gap-6 lg:grid-cols-[minmax(0,.8fr)_minmax(0,1.2fr)]">
             <div
-                class="rounded-[10px] border border-neutral-200 bg-neutral-50 p-4 dark:border-white/[0.08] dark:bg-white/[0.025]">
+                class="rounded-[10px] border border-neutral-200 bg-neutral-50 p-4 dark:border-white/[0.08] dark:bg-white/[0.05]">
                 <p class="text-[11px] font-medium text-neutral-500 dark:text-fg-faint">Base price</p>
                 <div class="mt-2 flex items-end gap-1.5">
                     <span x-show="selected === 'monthly'" x-cloak
diff --git a/resources/views/livewire/tags/deployments.blade.php b/resources/views/livewire/tags/deployments.blade.php
index c480a0c119..03eb633bc2 100644
--- a/resources/views/livewire/tags/deployments.blade.php
+++ b/resources/views/livewire/tags/deployments.blade.php
@@ -8,7 +8,7 @@
         @else
             <div class="data-table w-full">
                 <div
-                    class="grid grid-cols-[minmax(0,1fr)_minmax(8rem,.55fr)_8rem] border-b border-neutral-200 bg-neutral-50 px-4 py-2.5 text-[11px] font-medium text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.025] dark:text-fg-faint">
+                    class="grid grid-cols-[minmax(0,1fr)_minmax(8rem,.55fr)_8rem] border-b border-neutral-200 bg-neutral-50 px-4 py-2.5 text-[11px] font-medium text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.05] dark:text-fg-faint">
                     <span>Resource</span>
                     <span>Server</span>
                     <span>Status</span>
diff --git a/resources/views/livewire/tags/show.blade.php b/resources/views/livewire/tags/show.blade.php
index 1696382c0e..38f5286ab3 100644
--- a/resources/views/livewire/tags/show.blade.php
+++ b/resources/views/livewire/tags/show.blade.php
@@ -96,7 +96,7 @@
                 <div class="grid grid-cols-1 gap-3 sm:grid-cols-2 lg:grid-cols-4">
                     <template x-for="tag in paginatedTags" :key="tag.id">
                         <article
-                            class="group relative flex min-h-28 flex-col rounded-xl border border-neutral-200 bg-white p-3 shadow-sm transition-all hover:-translate-y-px hover:border-neutral-300 hover:shadow-md dark:border-white/[0.08] dark:bg-white/[0.025] dark:hover:border-white/[0.14]">
+                            class="group relative flex min-h-28 flex-col rounded-xl border border-neutral-200 bg-white p-3 shadow-sm transition-all hover:-translate-y-px hover:border-neutral-300 hover:shadow-md dark:border-white/[0.08] dark:bg-white/[0.05] dark:hover:border-white/[0.14]">
                             <a :href="tag.href" {{ wireNavigate() }} class="absolute inset-0 rounded-xl"
                                 :aria-label="`Open ${tag.name}`"></a>
 
@@ -121,15 +121,15 @@
                         </article>
                     </template>
                 </div>
-                <x-client-pagination x-show="filteredTags.length > 0" class="mt-3 rounded-xl border border-neutral-200 bg-white shadow-sm dark:border-white/[0.08] dark:bg-white/[0.025]"
+                <x-client-pagination x-show="filteredTags.length > 0" class="mt-3 rounded-xl border border-neutral-200 bg-white shadow-sm dark:border-white/[0.08] dark:bg-white/[0.05]"
                     summary="`${rangeStart}-${rangeEnd} of ${filteredTags.length}`" page-size-model="pageSize"
                     storage-key="coolify.page-size.tags" :options="[12, 24, 48, 96]" />
             </div>
 
             <div x-show="viewMode === 'table'"
-                class="overflow-hidden rounded-xl border border-neutral-200 bg-white shadow-sm dark:border-white/[0.08] dark:bg-white/[0.025]">
+                class="overflow-hidden rounded-xl border border-neutral-200 bg-white shadow-sm dark:border-white/[0.08] dark:bg-white/[0.05]">
                 <div
-                    class="tags-table-grid border-b border-neutral-200 bg-neutral-50 px-4 py-2.5 text-[11px] font-medium text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.025] dark:text-fg-faint">
+                    class="tags-table-grid border-b border-neutral-200 bg-neutral-50 px-4 py-2.5 text-[11px] font-medium text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.05] dark:text-fg-faint">
                     <div>Tag</div>
                     <div>Resources</div>
                     <div>Applications</div>
@@ -161,7 +161,7 @@
             </div>
 
             <div x-show="filteredTags.length === 0"
-                class="flex min-h-52 flex-col items-center justify-center rounded-xl border border-neutral-200 bg-white px-6 text-center dark:border-white/[0.08] dark:bg-white/[0.025]">
+                class="flex min-h-52 flex-col items-center justify-center rounded-xl border border-neutral-200 bg-white px-6 text-center dark:border-white/[0.08] dark:bg-white/[0.05]">
                 <x-reicon name="search" class="mb-3 size-6 text-neutral-300 dark:text-fg-faint" />
                 <p class="text-[13px] font-medium">No matching tags</p>
                 <p class="mt-1 text-[12px] text-neutral-500 dark:text-fg-dim">
@@ -250,7 +250,7 @@
         <div class="flex flex-col gap-6">
             <div class="grid grid-cols-1 gap-3 sm:grid-cols-3">
                 <div
-                    class="rounded-xl border border-neutral-200 bg-white p-3 dark:border-white/[0.08] dark:bg-white/[0.025]">
+                    class="rounded-xl border border-neutral-200 bg-white p-3 dark:border-white/[0.08] dark:bg-white/[0.05]">
                     <p class="text-[11px] font-medium text-neutral-500 dark:text-fg-faint">Resources</p>
                     <p class="mt-1 text-[20px] font-semibold tracking-tight text-black dark:text-fg">
                         {{ $resourceCount }}
@@ -260,7 +260,7 @@
                     </p>
                 </div>
                 <div
-                    class="rounded-xl border border-neutral-200 bg-white p-3 dark:border-white/[0.08] dark:bg-white/[0.025]">
+                    class="rounded-xl border border-neutral-200 bg-white p-3 dark:border-white/[0.08] dark:bg-white/[0.05]">
                     <p class="text-[11px] font-medium text-neutral-500 dark:text-fg-faint">Applications</p>
                     <p class="mt-1 text-[20px] font-semibold tracking-tight text-black dark:text-fg">
                         {{ $applications?->count() ?? 0 }}
@@ -270,7 +270,7 @@
                     </p>
                 </div>
                 <div
-                    class="rounded-xl border border-neutral-200 bg-white p-3 dark:border-white/[0.08] dark:bg-white/[0.025]">
+                    class="rounded-xl border border-neutral-200 bg-white p-3 dark:border-white/[0.08] dark:bg-white/[0.05]">
                     <p class="text-[11px] font-medium text-neutral-500 dark:text-fg-faint">Active deployments</p>
                     <p class="mt-1 text-[20px] font-semibold tracking-tight text-black dark:text-fg">
                         {{ collect($deploymentsPerTagPerServer ?? [])->flatten(1)->count() }}
@@ -308,7 +308,7 @@
                     <div class="grid grid-cols-1 gap-3 sm:grid-cols-2 lg:grid-cols-4">
                         @foreach ($applications ?? [] as $application)
                             <a {{ wireNavigate() }} href="{{ $application->link() }}"
-                                class="group flex min-h-24 flex-col rounded-lg border border-neutral-200 bg-neutral-50/70 p-3 transition-colors hover:border-neutral-300 hover:no-underline dark:border-white/[0.08] dark:bg-white/[0.025] dark:hover:border-white/[0.14]">
+                                class="group flex min-h-24 flex-col rounded-lg border border-neutral-200 bg-neutral-50/70 p-3 transition-colors hover:border-neutral-300 hover:no-underline dark:border-white/[0.08] dark:bg-white/[0.05] dark:hover:border-white/[0.14]">
                                 <div class="flex items-start gap-2.5">
                                     <div
                                         class="flex size-7 shrink-0 items-center justify-center rounded-md border border-neutral-200 bg-white text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.035] dark:text-fg-dim">
@@ -332,7 +332,7 @@
 
                         @foreach ($services ?? [] as $service)
                             <a {{ wireNavigate() }} href="{{ $service->link() }}"
-                                class="group flex min-h-24 flex-col rounded-lg border border-neutral-200 bg-neutral-50/70 p-3 transition-colors hover:border-neutral-300 hover:no-underline dark:border-white/[0.08] dark:bg-white/[0.025] dark:hover:border-white/[0.14]">
+                                class="group flex min-h-24 flex-col rounded-lg border border-neutral-200 bg-neutral-50/70 p-3 transition-colors hover:border-neutral-300 hover:no-underline dark:border-white/[0.08] dark:bg-white/[0.05] dark:hover:border-white/[0.14]">
                                 <div class="flex items-start gap-2.5">
                                     <div
                                         class="flex size-7 shrink-0 items-center justify-center rounded-md border border-neutral-200 bg-white text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.035] dark:text-fg-dim">
@@ -374,7 +374,7 @@
                         </div>
                     @else
                         <div
-                            class="grid min-w-[620px] grid-cols-[minmax(0,1fr)_minmax(10rem,.55fr)_7rem] border-b border-neutral-200 bg-neutral-50 px-4 py-2.5 text-[11px] font-medium text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.025] dark:text-fg-faint">
+                            class="grid min-w-[620px] grid-cols-[minmax(0,1fr)_minmax(10rem,.55fr)_7rem] border-b border-neutral-200 bg-neutral-50 px-4 py-2.5 text-[11px] font-medium text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.05] dark:text-fg-faint">
                             <div>Resource</div>
                             <div>Server</div>
                             <div>Status</div>
diff --git a/resources/views/livewire/team/danger-zone.blade.php b/resources/views/livewire/team/danger-zone.blade.php
index b31ef2c5ab..477121f719 100644
--- a/resources/views/livewire/team/danger-zone.blade.php
+++ b/resources/views/livewire/team/danger-zone.blade.php
@@ -88,7 +88,7 @@
                                     step2ButtonText="Permanently Delete" canGate="delete"
                                     :canResource="$team" />
                             @else
-                                <x-forms.button disabled tooltip="Resolve the requirements shown before deleting this team.">
+                                <x-forms.button isError disabled tooltip="Resolve the requirements shown before deleting this team.">
                                     Delete team
                                 </x-forms.button>
                             @endif
diff --git a/resources/views/livewire/terminal/index.blade.php b/resources/views/livewire/terminal/index.blade.php
index 6ccc7b9d0c..0a3f361596 100644
--- a/resources/views/livewire/terminal/index.blade.php
+++ b/resources/views/livewire/terminal/index.blade.php
@@ -176,11 +176,11 @@
             </div>
         @else
         <div wire:key="terminal-session-canvas" data-terminal-session-canvas
-            class="application-console-shell flex h-full min-h-0 flex-col overflow-hidden rounded-lg p-3 sm:p-6"
+            class="application-console-shell flex h-full min-h-0 flex-col overflow-hidden rounded-lg"
             :data-console-theme="consoleTheme"
             :style="{ '--terminal-scrollbar': themeAccents[consoleTheme] }">
             <header
-                class="terminal-session-toolbar absolute top-3 right-3 left-3 z-20 flex items-center gap-3 text-white select-none">
+                class="terminal-session-toolbar flex items-center gap-3 text-white select-none">
                 <div class="relative flex min-w-0 flex-1 items-center gap-2"
                     x-on:click.outside="targetOpen = false">
                     @if ($isLoadingContainers)
@@ -215,7 +215,7 @@
                         </button>
 
                         <div x-cloak x-show="targetOpen" x-transition.origin.top.left
-                            class="terminal-target-picker absolute top-11 left-0 z-50 w-80 overflow-hidden rounded-lg border shadow-[0_18px_50px_rgba(0,0,0,0.35)]">
+                            class="terminal-target-picker absolute top-11 left-0 z-50 w-80 overflow-hidden rounded-lg border shadow-[var(--shadow-dropdown)]">
                             <div class="border-b border-white/[0.08] p-1.5">
                                 <div class="relative">
                                     <x-reicon name="search"
@@ -264,7 +264,7 @@
                         :theme-accents="$consoleThemeAccents" />
             </header>
 
-            <div class="terminal-session-panel mt-8 flex min-h-0 flex-1 flex-col overflow-hidden">
+            <div class="terminal-session-panel flex min-h-0 flex-1 flex-col overflow-hidden p-3 sm:p-6">
             <div class="application-console-block min-h-0 flex-1 overflow-hidden">
                 @if ($isLoadingContainers)
                     <div class="flex h-full min-h-0 items-center justify-center">
@@ -287,7 +287,7 @@
                 @else
                     <div x-cloak x-show="!targetChosen" data-terminal-target-picker="launcher"
                         class="absolute inset-0 z-20 flex items-start justify-start p-6 sm:p-10">
-                        <div class="terminal-target-picker w-full max-w-md overflow-hidden rounded-lg border shadow-[0_18px_50px_rgba(0,0,0,0.28)]">
+                        <div class="terminal-target-picker w-full max-w-md overflow-hidden rounded-lg border shadow-[var(--shadow-dropdown)]">
                             <div class="border-b border-white/[0.08] p-2">
                                 <div class="px-1 pb-2">
                                     <div class="text-sm font-semibold text-white/80">Start a terminal session</div>
diff --git a/resources/views/source/all.blade.php b/resources/views/source/all.blade.php
index cdf18bf706..fc93d4a72c 100644
--- a/resources/views/source/all.blade.php
+++ b/resources/views/source/all.blade.php
@@ -75,7 +75,7 @@
             <div x-cloak x-show="viewMode === 'grid'" class="grid grid-cols-1 gap-3 sm:grid-cols-2 lg:grid-cols-4">
                 @foreach ($sources as $source)
                     @if ($source->getMorphClass() === 'App\Models\GithubApp')
-                        <a x-show="matches(@js([$source->name, 'GitHub', $source->organization, $source->isConnected() ? 'Connected' : 'Setup incomplete']))" class="group flex min-h-28 flex-col rounded-xl border border-neutral-200 bg-white p-3 shadow-sm transition-all hover:-translate-y-px hover:border-neutral-300 hover:no-underline hover:shadow-md dark:border-white/[0.08] dark:bg-white/[0.025] dark:hover:border-white/[0.14]"
+                        <a x-show="matches(@js([$source->name, 'GitHub', $source->organization, $source->isConnected() ? 'Connected' : 'Setup incomplete']))" class="group flex min-h-28 flex-col rounded-xl border border-neutral-200 bg-white p-3 shadow-sm transition-all hover:-translate-y-px hover:border-neutral-300 hover:no-underline hover:shadow-md dark:border-white/[0.08] dark:bg-white/[0.05] dark:hover:border-white/[0.14]"
                             {{ wireNavigate() }}
                             href="{{ route('source.github.show', ['github_app_uuid' => data_get($source, 'uuid')]) }}">
                             <div class="flex items-start gap-3">
@@ -102,7 +102,7 @@
                             </div>
                         </a>
                     @elseif ($source->getMorphClass() === 'App\Models\GitlabApp')
-                        <a x-show="matches(@js([$source->name, 'GitLab', $source->group_name, $source->isConnected() ? 'Connected' : 'Setup incomplete']))" class="group flex min-h-28 flex-col rounded-xl border border-neutral-200 bg-white p-3 shadow-sm transition-all hover:-translate-y-px hover:border-neutral-300 hover:no-underline hover:shadow-md dark:border-white/[0.08] dark:bg-white/[0.025] dark:hover:border-white/[0.14]"
+                        <a x-show="matches(@js([$source->name, 'GitLab', $source->group_name, $source->isConnected() ? 'Connected' : 'Setup incomplete']))" class="group flex min-h-28 flex-col rounded-xl border border-neutral-200 bg-white p-3 shadow-sm transition-all hover:-translate-y-px hover:border-neutral-300 hover:no-underline hover:shadow-md dark:border-white/[0.08] dark:bg-white/[0.05] dark:hover:border-white/[0.14]"
                             {{ wireNavigate() }}
                             href="{{ route('source.gitlab.show', ['gitlab_app_uuid' => data_get($source, 'uuid')]) }}">
                             <div class="flex items-start gap-3">
@@ -131,8 +131,8 @@
                     @endif
                 @endforeach
             </div>
-            <div x-show="viewMode === 'table'" class="overflow-x-auto rounded-xl border border-neutral-200 bg-white shadow-sm dark:border-white/[0.08] dark:bg-white/[0.025]">
-                <div class="grid min-w-[620px] grid-cols-[minmax(0,1fr)_minmax(10rem,.7fr)_9rem] border-b border-neutral-200 bg-neutral-50 px-4 py-2.5 text-[11px] font-medium text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.025] dark:text-fg-faint"><div>Source</div><div>Provider</div><div>Status</div></div>
+            <div x-show="viewMode === 'table'" class="overflow-x-auto rounded-xl border border-neutral-200 bg-white shadow-sm dark:border-white/[0.08] dark:bg-white/[0.05]">
+                <div class="grid min-w-[620px] grid-cols-[minmax(0,1fr)_minmax(10rem,.7fr)_9rem] border-b border-neutral-200 bg-neutral-50 px-4 py-2.5 text-[11px] font-medium text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.05] dark:text-fg-faint"><div>Source</div><div>Provider</div><div>Status</div></div>
                 @foreach ($sources as $source)
                     @php
                         $isGithub = $source->getMorphClass() === 'App\\Models\\GithubApp';
diff --git a/tests/Feature/Api/ApplicationDomainValidationApiTest.php b/tests/Feature/Api/ApplicationDomainValidationApiTest.php
new file mode 100644
index 0000000000..88533ce760
--- /dev/null
+++ b/tests/Feature/Api/ApplicationDomainValidationApiTest.php
@@ -0,0 +1,86 @@
+<?php
+
+use App\Enums\ProxyTypes;
+use App\Models\Application;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Visus\Cuid2\Cuid2;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    config(['app.maintenance.store' => 'array']);
+    InstanceSettings::forceCreate(['id' => 0, 'is_api_enabled' => true]);
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+
+    session(['currentTeam' => $this->team]);
+
+    $this->token = $this->user->createToken('test-token', ['*']);
+    $this->bearerToken = $this->token->plainTextToken;
+
+    $this->server = Server::factory()->create(['team_id' => $this->team->id]);
+
+    StandaloneDocker::withoutEvents(function () {
+        $this->destination = $this->server->standaloneDockers()->firstOrCreate(
+            ['network' => 'coolify'],
+            ['uuid' => (string) new Cuid2, 'name' => 'test-docker']
+        );
+    });
+
+    $this->project = Project::factory()->create(['team_id' => $this->team->id]);
+
+    // Project boot event auto-creates a 'production' environment
+    $this->environment = $this->project->environments()->first();
+
+    $this->application = Application::factory()->create([
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+    ]);
+});
+
+it('rejects wildcard domains on application updates regardless of proxy configuration', function (string $proxyType) {
+    $this->server->proxy = ['type' => $proxyType];
+    $this->server->save();
+    $originalDomain = $this->application->fqdn;
+
+    $this->withToken($this->bearerToken)
+        ->patchJson("/api/v1/applications/{$this->application->uuid}", [
+            'domains' => 'https://*.example.com',
+            'force_domain_override' => true,
+        ])
+        ->assertUnprocessable()
+        ->assertJsonPath('message', 'Validation failed.')
+        ->assertJsonPath('errors', fn (array $errors): bool => collect($errors)->flatten()->contains('Invalid URL: https://*.example.com'));
+
+    expect($this->application->fresh()->fqdn)->toBe($originalDomain);
+})->with([ProxyTypes::NONE->value, ProxyTypes::TRAEFIK->value]);
+
+it('rejects wildcard domains on application creation', function (string $proxyType) {
+    $this->server->proxy = ['type' => $proxyType];
+    $this->server->save();
+    $this->server->settings()->update(['is_reachable' => true, 'is_usable' => true]);
+    $count = Application::count();
+
+    $this->withToken($this->bearerToken)
+        ->postJson('/api/v1/applications/dockerimage', [
+            'project_uuid' => $this->project->uuid,
+            'environment_uuid' => $this->environment->uuid,
+            'server_uuid' => $this->server->uuid,
+            'docker_registry_image_name' => 'nginx',
+            'ports_exposes' => '80',
+            'domains' => 'https://*.example.com',
+        ])
+        ->assertUnprocessable()
+        ->assertJsonPath('message', 'Validation failed.')
+        ->assertJsonPath('errors', fn (array $errors): bool => collect($errors)->flatten()->contains('Invalid URL: https://*.example.com'));
+
+    expect(Application::count())->toBe($count);
+})->with([ProxyTypes::NONE->value, ProxyTypes::TRAEFIK->value]);
diff --git a/tests/Feature/Api/ApplicationSettingsApiTest.php b/tests/Feature/Api/ApplicationSettingsApiTest.php
index 55d25927a3..a4c22a2b7c 100644
--- a/tests/Feature/Api/ApplicationSettingsApiTest.php
+++ b/tests/Feature/Api/ApplicationSettingsApiTest.php
@@ -165,6 +165,61 @@ test('changing a domain port regenerates managed labels with the requested port'
         ->and($labels)->not->toContain('loadbalancer.server.port=3000');
 });
 
+test('compose domain ports are stored as overrides when updating through the API', function () {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'docker_compose_raw' => "services:\n  api:\n    image: nginx\n  frontend:\n    image: nginx\n",
+        'docker_compose_domains' => json_encode([
+            'api' => ['domain' => 'https://api.example.com'],
+            'frontend' => ['domain' => 'https://app.example.com'],
+        ]),
+    ]);
+
+    $this->withHeaders(applicationSettingsApiHeaders($this->bearerToken))
+        ->patchJson("/api/v1/applications/{$this->application->uuid}", [
+            'docker_compose_domains' => [
+                ['name' => 'api', 'domain' => 'https://api.example.com'],
+                ['name' => 'frontend', 'domain' => 'https://app.example.com:80'],
+            ],
+        ])
+        ->assertOk();
+
+    $application = $this->application->fresh();
+    $domains = json_decode($application->docker_compose_domains, true);
+
+    expect(data_get($domains, 'frontend.domain'))->toBe('https://app.example.com')
+        ->and($application->domain_port_overrides)->toBe([
+            'https://app.example.com' => 80,
+        ]);
+});
+
+test('compose domain ports are stored as overrides when creating through the API', function () {
+    Queue::fake();
+
+    $response = $this->withHeaders(applicationSettingsApiHeaders($this->bearerToken))
+        ->postJson('/api/v1/applications/public', [
+            'project_uuid' => $this->project->uuid,
+            'environment_uuid' => $this->environment->uuid,
+            'server_uuid' => $this->server->uuid,
+            'git_repository' => 'https://gitlab.com/coolify/compose-domain-port-test',
+            'git_branch' => 'main',
+            'build_pack' => 'dockercompose',
+            'autogenerate_domain' => false,
+            'docker_compose_domains' => [
+                ['name' => 'frontend', 'domain' => 'https://app.example.com:80'],
+            ],
+        ])
+        ->assertCreated();
+
+    $application = Application::where('uuid', $response->json('uuid'))->firstOrFail();
+    $domains = json_decode($application->docker_compose_domains, true);
+
+    expect(data_get($domains, 'frontend.domain'))->toBe('https://app.example.com')
+        ->and($application->domain_port_overrides)->toBe([
+            'https://app.example.com' => 80,
+        ]);
+});
+
 test('http basic auth updates regenerate managed labels', function () {
     $this->application->settings->update(['is_container_label_readonly_enabled' => true]);
     $this->application->update([
diff --git a/tests/Feature/Api/LifecycleApisTest.php b/tests/Feature/Api/LifecycleApisTest.php
index 4973453e93..49d6f66359 100644
--- a/tests/Feature/Api/LifecycleApisTest.php
+++ b/tests/Feature/Api/LifecycleApisTest.php
@@ -138,6 +138,16 @@ describe('POST /api/v1/databases/{uuid}/clone', function () {
             'destination_id' => $this->destination->id,
             'destination_type' => $this->destination->getMorphClass(),
         ]);
+        $backup = $database->scheduledBackups()->create([
+            'team_id' => $this->team->id,
+            'enabled' => true,
+            'frequency' => '0 0 * * *',
+            'save_s3' => false,
+        ]);
+        $backup->forceFill([
+            'last_execution_at' => now()->subDay(),
+            'missing_backup_notification_sent_at' => now(),
+        ])->save();
 
         $response = $this->withHeaders($this->headers)
             ->postJson("/api/v1/databases/{$database->uuid}/clone", [
@@ -149,11 +159,14 @@ describe('POST /api/v1/databases/{uuid}/clone', function () {
             ->assertJsonPath('message', 'Database cloned.');
 
         $cloned = StandalonePostgresql::where('uuid', $response->json('uuid'))->first();
+        $clonedBackup = $cloned->scheduledBackups()->sole();
         expect($cloned)->not->toBeNull()
             ->and($cloned->name)->toBe('cloned-db')
             ->and($cloned->environment_id)->toBe($database->environment_id)
             ->and($cloned->destination_id)->toBe($this->destination->id)
-            ->and(str($cloned->status)->startsWith('exited'))->toBeTrue();
+            ->and(str($cloned->status)->startsWith('exited'))->toBeTrue()
+            ->and($clonedBackup->last_execution_at)->toBeNull()
+            ->and($clonedBackup->missing_backup_notification_sent_at)->toBeNull();
     });
 
     test('creates renamed volumes when cloning a database with clone_volumes', function () {
diff --git a/tests/Feature/AppearanceThemeTest.php b/tests/Feature/AppearanceThemeTest.php
index d984f62850..c4022c87a2 100644
--- a/tests/Feature/AppearanceThemeTest.php
+++ b/tests/Feature/AppearanceThemeTest.php
@@ -3,6 +3,8 @@
 test('custom color theme is available and applied across theme controls', function () {
     $appearance = file_get_contents(resource_path('views/livewire/profile/appearance.blade.php'));
     $accountMenu = file_get_contents(resource_path('views/components/top-user-menu.blade.php'));
+    $component = file_get_contents(resource_path('views/components/theme-controls.blade.php'));
+    $picker = file_get_contents(resource_path('views/components/theme-controls/picker.blade.php'));
     $layout = file_get_contents(resource_path('views/layouts/base.blade.php'));
     $deploymentLogs = file_get_contents(resource_path('views/livewire/project/application/deployment/show.blade.php'));
     $serverTiming = file_get_contents(resource_path('views/components/server-timing-hud.blade.php'));
@@ -11,22 +13,23 @@ test('custom color theme is available and applied across theme controls', functi
     $utilities = file_get_contents(resource_path('css/utilities.css'));
 
     expect($appearance)
+        ->toContain('<x-theme-controls variant="full"')
+        ->and($accountMenu)
+        ->toContain('<x-theme-controls variant="menu"')
+        ->and($component)
         ->toContain("['value' => 'custom', 'label' => 'Custom'")
+        ->toContain('<x-theme-controls.picker')
+        ->and($picker)
         ->toContain('type="color"')
-        ->toContain('absolute inset-0 z-10 h-full w-full cursor-pointer opacity-0')
-        ->toContain('requestAnimationFrame(() =>')
         ->toContain('@input="previewThemeColor($event.target.value)"')
         ->toContain('@change="saveThemeColor($event.target.value)"')
+        ->toContain('aria-label="Custom theme color"')
+        ->toContain('setCustomMode')
+        ->and($layout)
+        ->toContain('window.themeControls')
+        ->toContain('requestAnimationFrame(() =>')
         ->toContain("localStorage.setItem('themeColor', color)")
         ->toContain("this.theme === 'custom'")
-        ->and($accountMenu)
-        ->toContain("['value' => 'custom', 'label' => 'Custom']")
-        ->toContain('aria-label="Custom theme color"')
-        ->toContain('requestAnimationFrame(() =>')
-        ->toContain('@input="previewThemeColor($event.target.value)"')
-        ->toContain('@change="saveThemeColor($event.target.value)"')
-        ->toContain("localStorage.setItem('themeColor', color)")
-        ->toContain('absolute inset-0 z-10 h-full w-full cursor-pointer opacity-0')
         ->and($layout)
         ->toContain("t === 'custom'")
         ->toContain("localStorage.themeColor || '#6b16ed'")
@@ -35,34 +38,35 @@ test('custom color theme is available and applied across theme controls', functi
         ->toContain("document.addEventListener('livewire:navigated', window.applyStoredTheme)")
         ->and($styles)
         ->toContain('html[data-theme="custom"]')
-        ->toContain('--theme-base-color: #6b16ed;')
-        ->toContain('--theme-bright-color: color-mix(in srgb, var(--theme-base-color) 85%, white);')
+        ->toContain('--theme-base-color: oklch(49.65% 0.2709 289.33);')
+        ->toContain('--theme-bright-color: color-mix(in srgb, var(--theme-base-color) 85%, oklch(100% 0 0));')
         ->toContain('--color-accent: var(--theme-bright-color);')
         ->toContain('--color-coollabs: var(--theme-bright-color);')
         ->toContain('--color-warning: var(--theme-bright-color);')
         ->toContain('--color-accent-foreground: var(--theme-accent-foreground);')
-        ->toContain('--color-fg-dim: #e4dfea;')
-        ->toContain('--color-fg-faint: #d8d2df;')
+        ->toContain('--color-fg-dim: oklch(91.08% 0.0157 306.4);')
+        ->toContain('--color-fg-faint: oklch(87.24% 0.0188 306.63);')
         ->toContain('html[data-theme="custom"] .control-selected')
         ->toContain('--theme-scrollbar-thumb: color-mix(in srgb, var(--theme-bright-color) 70%, var(--theme-accent-foreground));')
-        ->toContain('--theme-border-color: color-mix(in oklab, var(--theme-base-color) 42%, #52525b);')
-        ->toContain('--theme-placeholder-color: color-mix(in srgb, white 20%, var(--theme-base-color));')
+        ->toContain('--theme-border-color: color-mix(in oklab, var(--theme-base-color) 42%, oklch(44.19% 0.0146 285.79));')
+        ->toContain('--theme-fg-on-surface: oklch(from var(--theme-base-color) clamp(0.72, l, 0.86) min(c, 0.13) h);')
+        ->toContain('--theme-placeholder-color: oklch(from var(--theme-base-color) 0.62 min(c, 0.03) h);')
         ->toContain('html[data-theme="custom"] *')
         ->toContain('scrollbar-color: var(--theme-scrollbar-thumb) var(--color-panel);')
         ->toContain('html[data-theme="custom"] *::-webkit-scrollbar-thumb')
         ->toContain('html[data-theme="custom"] .application-settings-navigation')
         ->toContain('scrollbar-gutter: stable;')
-        ->toContain('--color-panel: color-mix(in oklab, var(--theme-base-color) 14%, #0c0c0d);')
-        ->toContain('--color-surface: color-mix(in oklab, var(--theme-base-color) 18%, #101011);')
+        ->toContain('--color-panel: color-mix(in oklab, var(--theme-base-color) 14%, oklch(15.48% 0.0021 286.15));')
+        ->toContain('--color-surface: color-mix(in oklab, var(--theme-base-color) 18%, oklch(17.35% 0.0020 286.18));')
         ->toContain('--coollabs-elevated: var(--color-surface);')
         ->toContain('--coollabs-recessed: var(--color-raised);')
-        ->toContain('--coollabs-base: color-mix(in oklab, var(--theme-base-color) 22%, #111112);')
+        ->toContain('--coollabs-base: color-mix(in oklab, var(--theme-base-color) 22%, oklch(17.81% 0.0020 286.19));')
         ->toContain('--color-content-surface: var(--coollabs-base);')
-        ->toContain('--coollabs-fill: color-mix(in oklab, var(--theme-base-color) 32%, #18181a);')
-        ->toContain('--color-nav-text: #e4dfea;')
-        ->toContain('--color-nav-muted: #d8d2df;')
-        ->toContain('--color-log: color-mix(in oklab, var(--theme-base-color) 20%, #080809);')
-        ->toContain('--color-log-toolbar: color-mix(in oklab, var(--theme-base-color) 26%, #101011);')
+        ->toContain('--coollabs-fill: color-mix(in oklab, var(--theme-base-color) 32%, oklch(20.99% 0.0039 286.06));')
+        ->toContain('--color-nav-text: oklch(91.08% 0.0157 306.4);')
+        ->toContain('--color-nav-muted: oklch(87.24% 0.0188 306.63);')
+        ->toContain('--color-log: color-mix(in oklab, var(--theme-base-color) 20%, oklch(13.49% 0.0024 286.07));')
+        ->toContain('--color-log-toolbar: color-mix(in oklab, var(--theme-base-color) 26%, oklch(17.35% 0.0020 286.18));')
         ->toContain('html[data-theme="custom"] .logs-viewer-toolbar')
         ->toContain('html[data-theme="custom"] .logs-viewer-timestamp')
         ->toContain('html[data-theme="custom"] #nprogress .bar')
@@ -78,7 +82,7 @@ test('custom color theme is available and applied across theme controls', functi
         ->toContain('border-color: var(--coollabs-hairline) !important;')
         ->toContain('html[data-theme="custom"] input::placeholder')
         ->toContain('color: var(--theme-placeholder-color) !important;')
-        ->toMatch('/html\[data-theme="custom"\] input::placeholder,[^{]+\{[^}]*opacity: 0\.7;/s')
+        ->toMatch('/html\[data-theme="custom"\] input::placeholder,[^{]+\{[^}]*opacity: 1;/s')
         ->toContain('html[data-theme="custom"] input:read-only')
         ->and($deploymentLogs)
         ->toContain('dark:bg-log')
diff --git a/tests/Feature/ApplicationClearDomainsTest.php b/tests/Feature/ApplicationClearDomainsTest.php
index 9a5b2576a7..7604614ed5 100644
--- a/tests/Feature/ApplicationClearDomainsTest.php
+++ b/tests/Feature/ApplicationClearDomainsTest.php
@@ -102,3 +102,28 @@ test('can clear application domains via empty string and save successfully', fun
     $application->refresh();
     expect($application->fqdn)->toBeNull();
 });
+
+test('can update general settings when the application has a wildcard domain', function () {
+    $application = Application::factory()->create([
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => StandaloneDocker::class,
+        'build_pack' => 'nixpacks',
+        'fqdn' => 'https://example.com,https://*.example.com',
+        'static_image' => 'nginx:alpine',
+        'base_directory' => '/',
+        'ports_exposes' => '3000',
+        'is_http_basic_auth_enabled' => false,
+        'redirect' => 'no',
+    ]);
+
+    Livewire::test(General::class, ['application' => $application])
+        ->assertSuccessful()
+        ->set('startCommand', 'node scripts/serve-prod.mjs')
+        ->call('submit', false)
+        ->assertHasNoErrors();
+
+    $application->refresh();
+    expect($application->fqdn)->toBe('https://example.com,https://*.example.com')
+        ->and($application->start_command)->toBe('node scripts/serve-prod.mjs');
+});
diff --git a/tests/Feature/ApplicationDestinationStatusBadgeTest.php b/tests/Feature/ApplicationDestinationStatusBadgeTest.php
index 9dfbedb563..43bac41486 100644
--- a/tests/Feature/ApplicationDestinationStatusBadgeTest.php
+++ b/tests/Feature/ApplicationDestinationStatusBadgeTest.php
@@ -5,7 +5,7 @@ it('uses the shared status summary in the primary application server card', func
     $applicationSection = str($view)->before('@else')->value();
 
     expect($applicationSection)
-        ->toContain('<x-status-summary :status="$resource->status" />')
+        ->toContain('<x-status-summary :status="$resource->status" align="right" />')
         ->not->toContain('<x-status :resource="$resource"');
 });
 
diff --git a/tests/Feature/ApplicationDomainsTest.php b/tests/Feature/ApplicationDomainsTest.php
index f2beb22f13..2c8ea4fe51 100644
--- a/tests/Feature/ApplicationDomainsTest.php
+++ b/tests/Feature/ApplicationDomainsTest.php
@@ -618,10 +618,10 @@ it('lists existing domains as individual rows', function () {
         ->assertSee('class="invisible absolute inset-0 size-4 rounded-sm"', false)
         ->assertSee('$el.previousElementSibling.classList.add(\'hidden\')', false)
         ->assertSee('x-on:error="$el.remove()"', false)
-        ->assertSee('class="min-w-0 flex-1 text-[13px]', false)
+        ->assertSee('class="min-w-0 flex-1 truncate text-[13px]', false)
         ->html();
 
-    expect(substr_count($html, 'this.$wire.updateRedirect('))->toBe(2);
+    expect(substr_count($html, 'this.$wire.updateRedirect('))->toBe(0);
 });
 
 it('shows the HTTP redirect control for HTTPS domains and persists changes', function () {
@@ -645,7 +645,7 @@ it('hides the HTTP redirect control for HTTP-only domains', function () {
         ->assertDontSee('Redirect HTTP to HTTPS');
 });
 
-it('shows one redirect direction control in each compose service header', function () {
+it('shows the compose service redirect control in domain settings', function () {
     $this->application->update([
         'build_pack' => 'dockercompose',
         'docker_compose_raw' => "services:\n  api:\n    image: nginx:alpine\n",
@@ -660,11 +660,13 @@ it('shows one redirect direction control in each compose service header', functi
     $html = Livewire::test(Domains::class, ['application' => $this->application->fresh()])
         ->assertSuccessful()
         ->assertSee('api')
+        ->call('startEdit', 0)
+        ->assertSee('www redirect')
         ->html();
 
     expect(substr_count($html, 'this.$wire.updateServiceRedirect('))->toBe(1)
         ->and(substr_count($html, 'this.$wire.updateRedirect('))->toBe(0)
-        ->and(substr_count($html, 'domain-direction-service-api'))->toBeGreaterThan(0);
+        ->and(substr_count($html, 'application-domain-direction-'))->toBeGreaterThan(0);
 });
 
 it('shows dns entries control next to Add', function () {
@@ -716,6 +718,63 @@ it('lists dns entries for domains that still need dns and omits working configur
         ->not->toContain('app.example.com');
 });
 
+it('does not use instance network addresses for dns entries on a remote server', function () {
+    InstanceSettings::get()->update([
+        'public_ipv4' => '198.51.100.20',
+        'public_ipv6' => '2001:db8::20',
+    ]);
+    $this->application->update(['fqdn' => 'https://app.example.com']);
+
+    $component = Livewire::test(Domains::class, ['application' => $this->application->fresh()]);
+    $records = $component->instance()->dnsRecordHints();
+
+    expect($records)->toBe([
+        [
+            'type' => 'A',
+            'name' => 'app.example.com',
+            'value' => '203.0.113.10',
+        ],
+    ]);
+});
+
+it('uses instance network addresses for dns entries on the localhost server', function () {
+    InstanceSettings::get()->update([
+        'public_ipv4' => '198.51.100.20',
+        'public_ipv6' => '2001:db8::20',
+    ]);
+    $localhost = Server::factory()->create([
+        'id' => 0,
+        'team_id' => $this->team->id,
+        'private_key_id' => $this->server->private_key_id,
+        'ip' => 'localhost',
+    ]);
+    $destination = StandaloneDocker::withoutEvents(fn () => StandaloneDocker::forceCreate([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'localhost-docker',
+        'network' => 'coolify-localhost',
+        'server_id' => $localhost->id,
+    ]));
+    $this->application->update([
+        'destination_id' => $destination->id,
+        'fqdn' => 'https://app.example.com',
+    ]);
+
+    $component = Livewire::test(Domains::class, ['application' => $this->application->fresh()]);
+
+    expect($component->instance()->dnsRecordHints())->toBe([
+        [
+            'type' => 'A',
+            'name' => 'app.example.com',
+            'value' => '198.51.100.20',
+        ],
+        [
+            'type' => 'AAAA',
+            'name' => 'app.example.com',
+            'value' => '2001:db8::20',
+        ],
+    ]);
+});
+
 it('shows cloudflare domain connect only on cloud with a key', function () {
     config([
         'constants.coolify.self_hosted' => false,
@@ -748,7 +807,7 @@ it('shows cloudflare domain connect only on cloud with a key', function () {
 
 it('adds a domain to the application', function () {
     Livewire::test(Domains::class, ['application' => $this->application->fresh()])
-        ->assertSee('+ Add')
+        ->assertSee('Add domain')
         ->set('newDomain', 'https://app.example.com')
         ->call('addDomain')
         ->assertHasNoErrors()
@@ -852,7 +911,7 @@ it('updates a domain in place via modal', function () {
         ->call('startEdit', 0)
         ->assertSet('showEditDomainModal', true)
         ->assertSet('editingDomain', 'https://old.example.com')
-        ->assertSee('Direction')
+        ->assertSee('www redirect')
         ->assertSee('Search engine indexing')
         ->set('editingDomainParts.scheme', 'https')
         ->set('editingDomainParts.host', 'new.example.com')
@@ -1230,7 +1289,7 @@ it('hides dns message text when dns status is ok', function () {
 
     Livewire::test(Domains::class, ['application' => $this->application->fresh()])
         ->assertSet('domainRows.0.dns_status', 'ok')
-        ->assertSee('DNS OK')
+        ->assertSee('DNS matches')
         ->assertDontSee('DNS points to 203.0.113.10')
         ->assertDontSee('Last checked');
 });
@@ -1829,33 +1888,33 @@ it('uses the compact service domains layout for compose applications', function
         ->toContain('application-compose-domain-group-{{ $redirectWireKey }}')
         ->toContain('class="application-settings-section-body mt-1 scroll-mt-28')
         ->toContain('bg-neutral-50 px-4 py-3 dark:border-white/10 dark:bg-white/[0.04]')
-        ->toContain('class="data-table-header domains-table-grid-service"')
-        ->toContain('<span>Direction</span>')
-        ->toContain('<span class="whitespace-nowrap">Search engine indexing</span>')
+        ->toContain('class="data-table-header service-domains-overview-grid"')
+        ->toContain('<span>Domain redirect</span>')
+        ->toContain('<span>Search indexing</span>')
         ->not->toContain('<span>Last checked</span>')
         ->not->toContain('id="edit-domain-direction"')
-        ->toContain('id="domain-direction-service-{{ $redirectWireKey }}"')
-        ->toContain('onChange="updateServiceRedirect"')
-        ->toContain("'showDirectionControl' => false")
+        ->toContain('wire:key="application-compose-domain-rows-{{ $redirectWireKey }}"')
+        ->toContain('id="application-domain-direction-{{ $editingKey }}"')
+        ->toContain("\$isCompose ? 'updateServiceRedirect' : 'updateRedirect'")
         ->not->toContain('title="No domains for this service"');
 });
 
-it('keeps search engine indexing table headers on one line', function () {
+it('uses concise search indexing headers in application and service domain tables', function () {
     $applicationView = file_get_contents(resource_path('views/livewire/project/application/domains.blade.php'));
     $serviceView = file_get_contents(resource_path('views/livewire/project/service/partials/domain-table.blade.php'));
 
-    expect(substr_count($applicationView, '<span class="whitespace-nowrap">Search engine indexing</span>'))
-        ->toBe(2)
+    expect(substr_count($applicationView, '<span>Search indexing</span>'))
+        ->toBe(1)
         ->and($serviceView)
-        ->toContain('<span class="whitespace-nowrap">Search engine indexing</span>');
+        ->toContain('<span>Search indexing</span>');
 });
 
-it('shows domain guidance in the application domains section', function () {
+it('shows save guidance in the application domain settings', function () {
     $view = file_get_contents(resource_path('views/livewire/project/application/domains.blade.php'));
 
     expect($view)
-        ->toContain('<p class="text-sm text-neutral-500 dark:text-fg-dim">')
-        ->toContain('{{ $helperText }}');
+        ->toContain('Indexing and redirect changes save automatically.')
+        ->toContain('<x-unsaved-bar action="updateDomain"');
 });
 
 it('does not render a last checked column in the domains table', function () {
@@ -1871,13 +1930,15 @@ it('uses compact labeled domain cards on mobile', function () {
     $row = file_get_contents(resource_path('views/livewire/project/application/partials/domain-row.blade.php'));
 
     expect($styles)
-        ->toContain('@media (max-width: 768px)')
-        ->toContain('.domains-mobile-label')
-        ->toContain('.domains-table-grid .listbox-trigger')
+        ->toContain('@container service-domains (max-width: 980px)')
+        ->toContain('.service-domain-detail-label')
+        ->toContain('.service-domains-overview-grid')
+        ->toContain('@container service-domains (max-width: 600px)')
+        ->toContain('.service-domain-mobile-summary')
         ->and($row)
-        ->toContain('domains-mobile-label')
-        ->toContain('Search engine indexing')
-        ->toContain('Direction');
+        ->toContain('service-domain-mobile-summary')
+        ->toContain('No redirects')
+        ->toContain('Noindex');
 });
 
 it('uses segmented fields when adding and editing application domains', function () {
@@ -2075,10 +2136,11 @@ it('updates search engine indexing from the domains view', function () {
     $this->application->update(['fqdn' => 'https://app.example.com,https://staging.example.com']);
 
     Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->call('startEdit', 0)
         ->assertSee('Noindex')
         ->assertSee('Indexable')
         ->assertSee('Search engine indexing')
-        ->assertSee('Direction')
+        ->assertSee('www redirect')
         ->assertSee('toggleNoindexDomain', false)
         ->assertSee('updateRedirect', false)
         ->assertSee('wire:ignore', false)
@@ -2319,7 +2381,7 @@ it('renders a portless domain link with an internal port badge for overrides', f
         ->not->toContain('Inherited from Ports Exposes');
 });
 
-it('shows an error badge when a domain has no internal port and ports exposes is empty', function () {
+it('shows a warning when a domain has no internal port and ports exposes is empty', function () {
     $this->application->update([
         'ports_exposes' => null,
         'fqdn' => 'https://example.com',
@@ -2330,7 +2392,8 @@ it('shows an error badge when a domain has no internal port and ports exposes is
         ->assertSet('domainRows.0.internal_port', null)
         ->assertSee('No internal port')
         ->assertDontSee('Internal port ')
-        ->assertSee('table-badge-danger', false);
+        ->assertSee('aria-label="No internal port"', false)
+        ->assertSee('Set Ports Exposes or a per-domain internal port', false);
 });
 
 it('keeps the internal port badge when a domain override exists without ports exposes', function () {
@@ -2356,7 +2419,7 @@ it('distinguishes an inherited internal port from a domain port override', funct
 
     Livewire::test(Domains::class, ['application' => $this->application->fresh()])
         ->assertSee('Internal port 3000')
-        ->assertSee('Inherited from Ports Exposes', false)
+        ->assertSee('Inherited from the application or Compose service port', false)
         ->assertDontSee('Custom internal port for this domain', false);
 });
 
@@ -2379,6 +2442,25 @@ it('shows the detected compose service port as the inherited internal port', fun
         ->assertDontSee('Internal port 3000');
 });
 
+it('does not show an application port as the inherited port for a compose service without a declared port', function () {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'ports_exposes' => '3000',
+        'docker_compose_raw' => "services:\n  backend:\n    build: ./backend\n  frontend:\n    build: ./frontend\n",
+        'docker_compose_domains' => json_encode([
+            'backend' => ['domain' => 'https://api.example.com'],
+            'frontend' => ['domain' => 'https://app.example.com'],
+        ]),
+        'fqdn' => null,
+        'domain_port_overrides' => null,
+    ]);
+
+    Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->assertSet('domainRows.0.internal_port', null)
+        ->assertSet('domainRows.1.internal_port', null)
+        ->assertDontSee('Internal port 3000');
+});
+
 it('shows the detected compose service port for preview domains', function () {
     $this->application->update([
         'build_pack' => 'dockercompose',
@@ -2402,6 +2484,27 @@ it('shows the detected compose service port for preview domains', function () {
         ->assertDontSee('Internal port 3000');
 });
 
+it('does not show an application port for a preview compose service without a declared port', function () {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'ports_exposes' => '3000',
+        'docker_compose_raw' => "services:\n  backend:\n    build: ./backend\n  frontend:\n    build: ./frontend\n",
+    ]);
+
+    $preview = ApplicationPreview::create([
+        'application_id' => $this->application->id,
+        'pull_request_id' => 8070,
+        'pull_request_html_url' => 'https://github.com/coollabsio/coolify/pull/8070',
+        'docker_compose_domains' => json_encode([
+            'frontend' => ['domain' => 'https://preview.example.com'],
+        ]),
+    ]);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->assertSet('domainRows.0.internal_port', null)
+        ->assertDontSee('Internal port 3000');
+});
+
 it('keeps a legacy port-bearing url port in the edit field as an internal port override', function () {
     $this->application->update([
         'ports_exposes' => '3000,8080',
@@ -2427,7 +2530,7 @@ it('stores compose domain port overrides without wiping other services', functio
         'build_pack' => 'dockercompose',
         'fqdn' => null,
         'ports_exposes' => '3000,8080',
-        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n  api:\n    image: node:alpine\n",
+        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n    expose: [8080]\n  api:\n    image: node:alpine\n",
         'docker_compose_domains' => json_encode([
             'api' => ['domain' => 'https://api.example.com', 'redirect' => 'both'],
         ]),
@@ -2457,6 +2560,31 @@ it('stores compose domain port overrides without wiping other services', functio
         ->toHaveKey('https://api.example.com', 4000);
 });
 
+it('saves an unrecognized compose domain port after confirming the warning', function () {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'fqdn' => null,
+        'ports_exposes' => '3000',
+        'docker_compose_raw' => "services:\n  frontend:\n    build: ./frontend\n",
+        'docker_compose_domains' => json_encode([
+            'frontend' => ['domain' => 'https://app.example.com'],
+        ]),
+        'domain_port_overrides' => null,
+    ]);
+
+    Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->call('startEdit', 0)
+        ->set('editingDomainParts.port', '80')
+        ->call('updateDomain')
+        ->assertSet('showPortWarningModal', true)
+        ->call('confirmUseUnknownPort')
+        ->assertSet('showPortWarningModal', false)
+        ->assertDispatched('success');
+
+    expect($this->application->fresh()->domain_port_overrides)
+        ->toBe(['https://app.example.com' => 80]);
+});
+
 it('prunes a compose domain port override when that domain is removed', function () {
     $this->application->update([
         'build_pack' => 'dockercompose',
@@ -2651,3 +2779,255 @@ it('does not warn when editing an application domain to a port already used by a
         ->assertSet('showPortWarningModal', false)
         ->assertDispatched('success');
 });
+
+it('does not inherit the application port for single-service compose domains', function (string $extraService, bool $isPreview, bool $isStatic) {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'ports_exposes' => '3000',
+        'docker_compose_raw' => "services:\n  web:\n    image: httpd:2.4-alpine\n".$extraService,
+        'docker_compose_domains' => json_encode([
+            'web' => ['domain' => 'https://apache.example.com'],
+        ]),
+        'fqdn' => null,
+        'domain_port_overrides' => null,
+    ]);
+
+    $this->application->settings()->update(['is_static' => $isStatic]);
+
+    if ($isPreview) {
+        $preview = ApplicationPreview::create([
+            'application_id' => $this->application->id,
+            'pull_request_id' => 1,
+            'pull_request_html_url' => 'https://github.com/coollabsio/coolify/pull/1',
+            'docker_compose_domains' => $this->application->docker_compose_domains,
+        ]);
+        $component = Livewire::test(PreviewDomains::class, ['preview' => $preview]);
+    } else {
+        $component = Livewire::test(Domains::class, ['application' => $this->application->fresh()]);
+    }
+
+    $component->assertSet('domainRows.0.internal_port', null)
+        ->assertSet('domainRows.0.has_port_override', false)
+        ->assertDontSee('Internal port 3000');
+})->with([
+    'web only' => '',
+    'web and database' => "  database:\n    image: postgres:16-alpine\n",
+])->with([false, true])->with([false, true]);
+
+it('checks compose ports against the selected service when saving domains', function (string $action, int $port, bool $warn) {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'ports_exposes' => '3000',
+        'docker_compose_raw' => <<<'YAML'
+services:
+  web:
+    image: nginx:alpine
+    expose:
+      - 8080
+      - 8081
+    ports:
+      - target: 8082
+        published: 18082
+      - "18083:8083"
+  api:
+    image: nginx:alpine
+    expose:
+      - 9090
+YAML,
+        'docker_compose_domains' => json_encode([
+            'web' => ['domain' => 'https://existing.example.com'],
+            'api' => ['domain' => 'https://api.example.com:9090'],
+        ]),
+    ]);
+
+    $component = Livewire::test(Domains::class, ['application' => $this->application->fresh()]);
+    if ($action === 'add') {
+        $component->set('newDomainService', 'web')
+            ->set('newDomainParts.host', 'new.example.com')
+            ->set('newDomainParts.port', (string) $port)
+            ->call('addDomain');
+        $domain = 'https://new.example.com';
+    } else {
+        $component->call('startEdit', 0)
+            ->set('editingDomainParts.port', (string) $port)
+            ->call('updateDomain');
+        $domain = 'https://existing.example.com';
+    }
+
+    $component->assertHasNoErrors()->assertSet('showPortWarningModal', $warn);
+
+    if ($warn) {
+        expect($this->application->fresh()->domain_port_overrides ?? [])->not->toHaveKey($domain);
+        $component->assertSet('unrecognizedPort', $port)
+            ->call('confirmUseUnknownPort')
+            ->assertSet('showPortWarningModal', false);
+    }
+
+    $component->assertDispatched('success');
+    expect($this->application->fresh()->domain_port_overrides[$domain] ?? null)->toBe($port);
+})->with(['add', 'edit'])->with([
+    'first exposed port' => [8080, false],
+    'second exposed port' => [8081, false],
+    'long syntax target' => [8082, false],
+    'short syntax target' => [8083, false],
+    'global port' => [3000, true],
+    'another service port' => [9090, true],
+    'published host port' => [18082, true],
+]);
+
+it('keeps an existing custom compose port without another warning', function () {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'ports_exposes' => '3000',
+        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n    expose: [8080]\n",
+        'docker_compose_domains' => json_encode(['web' => ['domain' => 'https://existing.example.com:7070']]),
+    ]);
+
+    Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->call('startEdit', 0)
+        ->assertSet('editingDomainParts.port', '7070')
+        ->call('updateDomain')
+        ->assertHasNoErrors()
+        ->assertSet('showPortWarningModal', false)
+        ->assertDispatched('success');
+
+    expect($this->application->fresh()->domain_port_overrides['https://existing.example.com'] ?? null)->toBe(7070);
+});
+
+it('keeps the selected application domain when a refresh reorders dns rows', function (bool $compose) {
+    $first = 'https://first.example.com';
+    $second = 'https://second.example.com';
+    $this->application->update($compose ? [
+        'build_pack' => 'dockercompose',
+        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n    expose: [80]\n",
+        'docker_compose_domains' => json_encode(['web' => ['domain' => "$first,$second"]]),
+    ] : ['fqdn' => "$first,$second"]);
+
+    $component = Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->call('startEdit', 0)
+        ->set('editingDomainParts.host', 'renamed.example.com');
+    $this->application->update(['domain_dns_statuses' => [
+        ($compose ? 'web|' : '').$second => ['status' => 'failed', 'message' => 'Mismatch'],
+    ]]);
+
+    $component->call('refreshDomains')
+        ->assertSet('editingIndex', 1)
+        ->assertSet('editingDomainParts.host', 'renamed.example.com')
+        ->call('toggleNoindexDomain', $first, 'noindex')
+        ->call('updateDomain')
+        ->assertHasNoErrors();
+
+    $this->application->refresh();
+    $domains = $compose ? json_decode($this->application->docker_compose_domains, true)['web']['domain'] : $this->application->fqdn;
+    expect(explode(',', $domains))->toBe(['https://renamed.example.com', $second]);
+})->with([false, true]);
+
+it('inherits application counterpart ports without changing configured counterparts', function (bool $compose, ?int $override, string $redirect) {
+    $host = $redirect === 'www' ? 'app.example.com' : 'www.app.example.com';
+    $counterpart = $redirect === 'www' ? 'www.app.example.com' : 'app.example.com';
+    $url = "https://$host/blog";
+    $pairedUrl = "https://$counterpart/blog";
+    $existing = 'http://existing.example.com,https://www.existing.example.com';
+    $this->application->update(array_merge([
+        'ports_exposes' => '80',
+        'domain_port_overrides' => array_filter([
+            $url => $override,
+            'https://www.existing.example.com' => 9090,
+        ], fn ($port) => $port !== null),
+    ], $compose ? [
+        'build_pack' => 'dockercompose',
+        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n    expose: [80]\n",
+        'docker_compose_domains' => json_encode(['web' => ['domain' => "$url,$existing"]]),
+    ] : ['fqdn' => "$url,$existing"]));
+
+    $component = Livewire::test(Domains::class, ['application' => $this->application->fresh()]);
+    if ($compose) {
+        $component->call('updateServiceRedirect', 'web', $redirect);
+    } else {
+        $component->call('updateRedirect', $redirect);
+    }
+    $component->assertHasNoErrors()->assertSet('showPortWarningModal', false);
+
+    $this->application->refresh();
+    $domains = $compose ? json_decode($this->application->docker_compose_domains, true)['web']['domain'] : $this->application->fqdn;
+    expect($domains)->toContain($pairedUrl)->toContain($existing)
+        ->and($this->application->domain_port_overrides[$pairedUrl] ?? 80)->toBe($override ?? 80)
+        ->and($this->application->domain_port_overrides[$url] ?? null)->toBe($override)
+        ->and($this->application->domain_port_overrides['https://www.existing.example.com'])->toBe(9090);
+})->with([false, true])->with([null, 8080])->with(['www', 'non-www']);
+
+it('preserves pending application redirect through refresh and resolves its domain conflict', function (bool $compose, bool $cancel) {
+    Application::factory()->create([
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+        'fqdn' => 'https://www.pending.example.com',
+        'build_pack' => 'nixpacks',
+    ]);
+    $url = 'https://pending.example.com';
+    $this->application->update(array_merge([
+        'domain_port_overrides' => [$url => 8080],
+    ], $compose ? [
+        'build_pack' => 'dockercompose',
+        'docker_compose_raw' => "services:\n  web.app:\n    image: nginx:alpine\n    expose: [80]\n",
+        'docker_compose_domains' => json_encode([
+            'web.app' => ['domain' => $url, 'redirect' => 'both'],
+            'occupied' => ['domain' => 'https://www.pending.example.com'],
+        ]),
+    ] : ['fqdn' => $url]));
+
+    $component = Livewire::test(Domains::class, ['application' => $this->application->fresh()]);
+    $property = $compose ? 'serviceRedirects.'.str_replace('.', '__dot__', 'web.app') : 'redirect';
+    if ($compose) {
+        $component->call('updateServiceRedirect', 'web.app', 'www');
+    } else {
+        $component->call('updateRedirect', 'www');
+    }
+    $component->assertSet('showDomainConflictModal', true)
+        ->call('refreshDomains')
+        ->assertSet($property, 'www');
+
+    if ($cancel) {
+        $component->set('showDomainConflictModal', false)
+            ->assertSet($property, 'both')
+            ->assertSet('pendingAction', null)
+            ->assertSet('pendingRedirectService', null);
+    } else {
+        $component->call('confirmDomainUsage')
+            ->assertHasNoErrors()
+            ->assertSet('pendingAction', null)
+            ->assertSet('pendingRedirectService', null)
+            ->assertSet($property, 'www');
+    }
+
+    $this->application->refresh();
+    $storedRedirect = $compose ? json_decode($this->application->docker_compose_domains, true)['web.app']['redirect'] : $this->application->redirect;
+    expect($storedRedirect)->toBe($cancel ? 'both' : 'www');
+    if (! $cancel) {
+        expect($this->application->domain_port_overrides['https://www.pending.example.com'] ?? null)->toBe(8080);
+    }
+})->with([false, true])->with([false, true]);
+
+it('keeps the selected application domain when removing an earlier row', function () {
+    $this->application->update(['fqdn' => 'https://first.example.com,https://second.example.com']);
+
+    Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->call('startEdit', 1)
+        ->call('removeDomain', 0)
+        ->assertSet('editingIndex', 0)
+        ->set('editingDomainParts.host', 'renamed.example.com')
+        ->call('updateDomain')
+        ->assertHasNoErrors();
+
+    expect($this->application->fresh()->fqdn)->toBe('https://renamed.example.com');
+});
+
+it('prevents members from cancelling protected application redirect conflict state', function () {
+    $this->team->members()->updateExistingPivot($this->user->id, ['role' => 'member']);
+    $this->actingAs($this->user->fresh());
+
+    Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->set('showDomainConflictModal', true)
+        ->set('showDomainConflictModal', false)
+        ->assertForbidden();
+});
diff --git a/tests/Feature/ApplicationParserDockerComposeDomainsTest.php b/tests/Feature/ApplicationParserDockerComposeDomainsTest.php
index 30305ef596..10e312b545 100644
--- a/tests/Feature/ApplicationParserDockerComposeDomainsTest.php
+++ b/tests/Feature/ApplicationParserDockerComposeDomainsTest.php
@@ -1,6 +1,7 @@
 <?php
 
 use App\Models\Application;
+use App\Models\ApplicationPreview;
 use App\Models\Environment;
 use App\Models\PrivateKey;
 use App\Models\Project;
@@ -570,17 +571,19 @@ YAML,
         ->toBeTrue();
 });
 
-test('applicationParser compose labels use the first ports_exposes value when a portless domain has no override', function () {
+test('single-service compose leaves undeclared ports to proxy discovery', function (int $parserVersion, string $extraService, bool $isPreview) {
     $application = disableExactProxyLabels(Application::factory()->create([
         'environment_id' => $this->environment->id,
         'destination_id' => $this->destination->id,
         'destination_type' => StandaloneDocker::class,
         'build_pack' => 'dockercompose',
+        'compose_parsing_version' => $parserVersion,
         'ports_exposes' => '3000,8080',
-        'docker_compose_raw' => <<<'YAML'
+        'docker_compose_raw' => <<<YAML
 services:
   frontend:
-    image: myapp/frontend:latest
+    image: httpd:2.4-alpine
+{$extraService}
 YAML,
         'fqdn' => null,
         'domain_port_overrides' => null,
@@ -589,16 +592,29 @@ YAML,
         ]),
     ]));
 
-    $parsedCompose = applicationParser($application->fresh());
-    $labels = collect(data_get($parsedCompose, 'services.frontend.labels'));
+    $preview = $isPreview ? ApplicationPreview::create([
+        'application_id' => $application->id,
+        'pull_request_id' => 1,
+        'pull_request_html_url' => 'https://github.com/coollabsio/coolify/pull/1',
+        'docker_compose_domains' => $application->docker_compose_domains,
+    ]) : null;
 
-    expect($labels->contains(fn (string $label): bool => str_ends_with($label, '.loadbalancer.server.port=3000')))
-        ->toBeTrue()
-        ->and($labels->contains(fn (string $label): bool => str_contains($label, 'reverse_proxy={{upstreams 3000}}')))
+    $parsedCompose = $application->fresh()->parse(
+        pull_request_id: $preview?->pull_request_id ?? 0,
+        preview_id: $preview?->id,
+    );
+    $labels = collect(data_get($parsedCompose, 'services'))->flatMap(fn ($service) => data_get($service, 'labels', []));
+
+    expect($labels->contains(fn (string $label): bool => str_contains($label, '.loadbalancer.server.port=')))
+        ->toBeFalse()
+        ->and($labels->contains(fn (string $label): bool => str_contains($label, 'reverse_proxy={{upstreams}}')))
         ->toBeTrue()
         ->and($labels->contains(fn (string $label): bool => str_contains($label, 'Host(`frontend.example.com`)')))
         ->toBeTrue();
-});
+})->with([2, 3])->with([
+    'web only' => '',
+    'web and database' => "  database:\n    image: postgres:16-alpine",
+])->with([false, true]);
 
 test('applicationParser compose labels prefer the service exposed port over application ports_exposes', function (string $portConfiguration) {
     $application = disableExactProxyLabels(Application::factory()->create([
@@ -631,3 +647,37 @@ YAML,
     'short port syntax' => "    ports:\n      - '18069:8069'",
     'long port syntax' => "    ports:\n      - target: 8069\n        published: 18069",
 ]);
+
+test('applicationParser does not apply an application port to compose services without a declared port', function () {
+    $application = disableExactProxyLabels(Application::factory()->create([
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => StandaloneDocker::class,
+        'build_pack' => 'dockercompose',
+        'ports_exposes' => '3000',
+        'docker_compose_raw' => <<<'YAML'
+services:
+  postgres:
+    image: postgres:16-alpine
+  backend:
+    build: ./backend
+  frontend:
+    build: ./frontend
+YAML,
+        'fqdn' => null,
+        'domain_port_overrides' => null,
+        'docker_compose_domains' => json_encode([
+            'backend' => ['domain' => 'https://api.example.com'],
+            'frontend' => ['domain' => 'https://app.example.com'],
+        ]),
+    ]));
+
+    $services = data_get(applicationParser($application->fresh()), 'services');
+    $backendLabels = collect(data_get($services, 'backend.labels'));
+    $frontendLabels = collect(data_get($services, 'frontend.labels'));
+
+    expect($backendLabels->contains(fn (string $label): bool => str_contains($label, '.loadbalancer.server.port=')))
+        ->toBeFalse()
+        ->and($frontendLabels->contains(fn (string $label): bool => str_contains($label, '.loadbalancer.server.port=')))
+        ->toBeFalse();
+});
diff --git a/tests/Feature/ApplicationPreviewSettingsTest.php b/tests/Feature/ApplicationPreviewSettingsTest.php
new file mode 100644
index 0000000000..e5f69f4ee1
--- /dev/null
+++ b/tests/Feature/ApplicationPreviewSettingsTest.php
@@ -0,0 +1,150 @@
+<?php
+
+use App\Livewire\Project\Application\Previews;
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\PrivateKey;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Str;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    $this->withoutVite();
+    config(['app.maintenance.driver' => 'file']);
+
+    InstanceSettings::unguarded(fn () => InstanceSettings::updateOrCreate(
+        ['id' => 0],
+        [
+            'id' => 0,
+            'is_dns_validation_enabled' => false,
+        ]
+    ));
+
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+
+    $this->actingAs($this->user);
+    session(['currentTeam' => $this->team]);
+
+    $key = PrivateKey::withoutEvents(fn () => PrivateKey::forceCreate([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test Key',
+        'private_key' => 'test-key',
+        'team_id' => $this->team->id,
+        'created_at' => now(),
+        'updated_at' => now(),
+    ]));
+
+    $this->server = Server::factory()->create([
+        'team_id' => $this->team->id,
+        'private_key_id' => $key->id,
+        'ip' => '203.0.113.10',
+    ]);
+
+    $this->server->settings()->update([
+        'is_reachable' => true,
+        'is_usable' => true,
+    ]);
+
+    StandaloneDocker::withoutEvents(function () {
+        $this->destination = StandaloneDocker::firstOrCreate(
+            ['server_id' => $this->server->id, 'network' => 'coolify'],
+            ['uuid' => (string) Str::uuid(), 'name' => 'test-docker']
+        );
+    });
+
+    $this->project = Project::factory()->create(['team_id' => $this->team->id]);
+    $this->environment = Environment::factory()->create(['project_id' => $this->project->id]);
+
+    $this->application = Application::factory()->create([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Preview App',
+        'preview_url_template' => '{{pr_id}}.{{domain}}',
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+        'fqdn' => null,
+        'redirect' => 'both',
+        'build_pack' => 'nixpacks',
+    ]);
+
+    $this->application->settings()->update([
+        'is_container_label_readonly_enabled' => true,
+    ]);
+});
+
+it('shows preview settings and persists changes independently of preview inputs', function () {
+    Livewire::test(Previews::class, ['application' => $this->application])
+        ->assertSee('PR deployment access')
+        ->assertSet('isPreviewDeploymentsEnabled', false)
+        ->set('manualPullRequestId', -1)
+        ->set('isPreviewDeploymentsEnabled', true)
+        ->set('isPrDeploymentsPublicEnabled', true)
+        ->call('savePreviewSettings')
+        ->assertHasNoErrors()
+        ->assertDispatched('success');
+
+    expect($this->application->fresh()->settings)
+        ->is_preview_deployments_enabled->toBeTrue()
+        ->is_pr_deployments_public_enabled->toBeTrue();
+
+    Livewire::test(Previews::class, ['application' => $this->application->fresh()])
+        ->assertSet('isPreviewDeploymentsEnabled', true)
+        ->assertSet('isPrDeploymentsPublicEnabled', true)
+        ->set('isPreviewDeploymentsEnabled', false)
+        ->call('savePreviewSettings');
+
+    expect($this->application->fresh()->settings->is_preview_deployments_enabled)->toBeFalse();
+});
+
+it('renders preview deployment enablement as a section action', function () {
+    Livewire::test(Previews::class, ['application' => $this->application])
+        ->assertSee('Enable preview deployments')
+        ->assertDontSeeHtml('id="isPreviewDeploymentsEnabled"')
+        ->call('togglePreviewDeployments')
+        ->assertSee('Disable preview deployments')
+        ->assertSet('isPreviewDeploymentsEnabled', true);
+
+    expect($this->application->fresh()->settings->is_preview_deployments_enabled)->toBeTrue();
+});
+
+it('does not show git preview settings for non-git applications', function (string $buildPack, ?string $dockerfile) {
+    $this->application->update(['build_pack' => $buildPack, 'dockerfile' => $dockerfile]);
+
+    Livewire::test(Previews::class, ['application' => $this->application->fresh()])
+        ->assertDontSee('PR deployment access');
+})->with([['dockerimage', null], ['dockerfile', 'FROM nginx']]);
+
+it('denies preview setting changes without application update permission', function (string $role, bool $otherTeam) {
+    $user = User::factory()->create();
+    $team = $otherTeam ? Team::factory()->create() : $this->team;
+    $team->members()->attach($user->id, ['role' => $role]);
+    $this->actingAs($user);
+    session(['currentTeam' => $team]);
+
+    Livewire::test(Previews::class, ['application' => $this->application])
+        ->set('isPreviewDeploymentsEnabled', true)
+        ->set('isPrDeploymentsPublicEnabled', true)
+        ->call('savePreviewSettings')
+        ->assertForbidden();
+
+    expect($this->application->fresh()->settings)
+        ->is_preview_deployments_enabled->toBeFalse()
+        ->is_pr_deployments_public_enabled->toBeFalse();
+})->with([['member', false], ['owner', true]]);
+
+it('removes preview settings from Advanced including its persistence path', function () {
+    expect(file_get_contents(resource_path('views/livewire/project/application/advanced.blade.php')))
+        ->not->toContain('isPreviewDeploymentsEnabled', 'isPrDeploymentsPublicEnabled');
+    expect(file_get_contents(app_path('Livewire/Project/Application/Advanced.php')))
+        ->not->toContain('is_preview_deployments_enabled', 'is_pr_deployments_public_enabled');
+});
diff --git a/tests/Feature/Auth/TwoFactorChallengeAccessTest.php b/tests/Feature/Auth/TwoFactorChallengeAccessTest.php
index f0dd97cc31..a46f6b35c8 100644
--- a/tests/Feature/Auth/TwoFactorChallengeAccessTest.php
+++ b/tests/Feature/Auth/TwoFactorChallengeAccessTest.php
@@ -3,7 +3,11 @@
 use App\Models\InstanceSettings;
 use App\Models\Team;
 use App\Models\User;
+use Illuminate\Contracts\Debug\ExceptionHandler;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Http\Request;
+use Illuminate\Session\TokenMismatchException;
+use Illuminate\Support\Facades\Route;
 
 uses(RefreshDatabase::class);
 
@@ -78,3 +82,33 @@ it('renders 419 error page with login link instead of previous url', function ()
     expect($view)->toContain('error-shell');
     expect($view)->not->toContain('url()->previous()');
 });
+
+it('redirects an authenticated stale two-factor submission home instead of showing 419', function () {
+    $request = Request::create('/two-factor-challenge', 'POST');
+    $request->setRouteResolver(fn () => Route::getRoutes()->match($request));
+    $request->setUserResolver(fn () => $this->user);
+
+    $response = app(ExceptionHandler::class)->render($request, new TokenMismatchException('CSRF token mismatch.'));
+
+    expect($response->getStatusCode())->toBe(302)
+        ->and($response->headers->get('Location'))->toBe(url('/'));
+});
+
+it('still returns 419 for a stale two-factor submission without an authenticated session', function () {
+    $request = Request::create('/two-factor-challenge', 'POST');
+    $request->setRouteResolver(fn () => Route::getRoutes()->match($request));
+
+    $response = app(ExceptionHandler::class)->render($request, new TokenMismatchException('CSRF token mismatch.'));
+
+    expect($response->getStatusCode())->toBe(419);
+});
+
+it('keeps the 419 for stale tokens on routes other than login and the two-factor challenge', function () {
+    $request = Request::create('/two-factor-challenge', 'GET');
+    $request->setRouteResolver(fn () => Route::getRoutes()->match($request));
+    $request->setUserResolver(fn () => $this->user);
+
+    $response = app(ExceptionHandler::class)->render($request, new TokenMismatchException('CSRF token mismatch.'));
+
+    expect($response->getStatusCode())->toBe(419);
+});
diff --git a/tests/Feature/BackupEditValidationTest.php b/tests/Feature/BackupEditValidationTest.php
index 42a430a491..03af1bea4f 100644
--- a/tests/Feature/BackupEditValidationTest.php
+++ b/tests/Feature/BackupEditValidationTest.php
@@ -247,6 +247,7 @@ it('redirects to executions after queuing a database backup with unusable S3 sto
         'timeout' => 3600,
     ]);
     $database = $backup->database;
+    $database->update(['status' => 'running:healthy']);
     $parameters = [
         'project_uuid' => $database->project()->uuid,
         'environment_uuid' => $database->environment->uuid,
@@ -509,7 +510,7 @@ it('subscribes to database status broadcasts so Backup Now can refresh without a
         ->toHaveKey('databaseUpdated');
 });
 
-it('shows Backup Now after refresh when the database becomes running', function () {
+it('enables Back up now after refresh when the database becomes running', function () {
     $backup = createBackupForEditValidationTest($this->team, [
         'enabled' => true,
     ]);
@@ -521,17 +522,21 @@ it('shows Backup Now after refresh when the database becomes running', function
         'availableS3Storages' => $this->team->s3s,
         'status' => 'exited:unhealthy',
     ])
-        ->assertDontSee('Backup Now')
+        ->assertSee('Back up now')
         ->assertSet('status', 'exited:unhealthy');
 
+    expect($component->html())->toMatch('/<button\s+disabled[^>]*wire:click="backupNow"/s');
+
     $database->update(['status' => 'running:healthy']);
 
     $component->call('refreshStatus')
         ->assertSet('status', 'running:healthy')
-        ->assertSee('Backup Now');
+        ->assertSee('Back up now');
+
+    expect($component->html())->not->toMatch('/<button\s+disabled[^>]*wire:click="backupNow"/s');
 });
 
-it('hides Backup Now after refresh when the database stops', function () {
+it('disables Back up now after refresh when the database stops', function () {
     $backup = createBackupForEditValidationTest($this->team, [
         'enabled' => true,
     ]);
@@ -543,12 +548,33 @@ it('hides Backup Now after refresh when the database stops', function () {
         'availableS3Storages' => $this->team->s3s,
         'status' => 'running:healthy',
     ])
-        ->assertSee('Backup Now')
+        ->assertSee('Back up now')
         ->assertSet('status', 'running:healthy');
 
     $database->update(['status' => 'exited:unhealthy']);
 
     $component->call('refreshStatus')
         ->assertSet('status', 'exited:unhealthy')
-        ->assertDontSee('Backup Now');
+        ->assertSee('Back up now');
+
+    expect($component->html())->toMatch('/<button\s+disabled[^>]*wire:click="backupNow"/s');
+});
+
+it('renders S3 backup selectors outside the scrollable modal', function () {
+    createS3StorageForBackupEditValidationTest($this->team);
+    $backup = createBackupForEditValidationTest($this->team);
+    $html = Livewire::test(BackupEdit::class, [
+        'backup' => $backup->fresh(),
+        'availableS3Storages' => $this->team->s3s,
+        'section' => 's3',
+    ])->html();
+
+    $dom = new DOMDocument;
+    @$dom->loadHTML($html);
+    $xpath = new DOMXPath($dom);
+    foreach (['s3StorageId-panel', 'disableLocalBackup-panel'] as $panelId) {
+        $panels = $xpath->query('//template[@x-teleport="body"]/div[@id="'.$panelId.'"]');
+        expect($panels->length)->toBe(1);
+        expect($panels->item(0)->getAttribute('style'))->toContain('position: fixed', 'z-index: 9999');
+    }
 });
diff --git a/tests/Feature/BackupNowAvailabilityTest.php b/tests/Feature/BackupNowAvailabilityTest.php
new file mode 100644
index 0000000000..7c103e001f
--- /dev/null
+++ b/tests/Feature/BackupNowAvailabilityTest.php
@@ -0,0 +1,132 @@
+<?php
+
+use App\Jobs\DatabaseBackupJob;
+use App\Livewire\Project\Database\BackupEdit;
+use App\Livewire\Project\Database\BackupNow;
+use App\Livewire\Project\Service\VolumeBackup\Index;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\ScheduledDatabaseBackup;
+use App\Models\Server;
+use App\Models\Service;
+use App\Models\ServiceDatabase;
+use App\Models\StandaloneDocker;
+use App\Models\StandalonePostgresql;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Queue;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::forceCreate(['id' => 0]);
+    $team = Team::factory()->create();
+    $user = User::factory()->create();
+    $user->teams()->attach($team, ['role' => 'owner']);
+    $this->actingAs($user);
+    session(['currentTeam' => $team]);
+    $server = Server::factory()->create(['team_id' => $team->id]);
+    $destination = StandaloneDocker::where('server_id', $server->id)->firstOrFail();
+    $project = Project::factory()->create(['team_id' => $team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+    $resourceAttributes = [
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+    ];
+    $this->service = Service::factory()->create(['server_id' => $server->id, ...$resourceAttributes]);
+    $this->databases = [
+        'standalone' => StandalonePostgresql::create([
+            ...$resourceAttributes,
+            'name' => 'postgres',
+            'postgres_password' => 'password',
+        ]),
+        'service' => ServiceDatabase::create([
+            'service_id' => $this->service->id,
+            'name' => 'postgres',
+            'image' => 'postgres:16-alpine',
+            'custom_type' => 'postgresql',
+        ]),
+    ];
+    $this->backups = collect($this->databases)->map(fn ($database) => ScheduledDatabaseBackup::create([
+        'team_id' => $team->id,
+        'frequency' => 'daily',
+        'database_id' => $database->id,
+        'database_type' => $database->getMorphClass(),
+    ]));
+    Queue::fake();
+});
+
+dataset('database backup controls', [
+    'standalone settings' => [BackupEdit::class, 'standalone'],
+    'service settings' => [BackupEdit::class, 'service'],
+    'standalone button' => [BackupNow::class, 'standalone'],
+    'service button' => [BackupNow::class, 'service'],
+    'service list' => [Index::class, 'service'],
+]);
+
+it('only enables and queues database backups for running targets', function (string $componentClass, string $type, string $status, bool $running) {
+    $database = $this->databases[$type];
+    $database->update(['status' => $status]);
+    $backup = $this->backups[$type]->fresh();
+    $parameters = $componentClass === Index::class
+        ? ['service' => $this->service]
+        : ['backup' => $backup, ...($componentClass === BackupEdit::class ? ['availableS3Storages' => collect()] : [])];
+    $component = Livewire::test($componentClass, $parameters);
+    $dom = new DOMDocument;
+    @$dom->loadHTML($component->html());
+    $buttons = (new DOMXPath($dom))->query('//button');
+    $backupButtons = [];
+    foreach ($buttons as $button) {
+        if (str_starts_with($button->getAttribute('wire:click'), 'backupNow') || str_starts_with($button->getAttribute('wire:click.stop'), 'backupNow')) {
+            $backupButtons[] = $button;
+        }
+    }
+    expect($backupButtons)->toHaveCount(1);
+    expect($backupButtons[0]->hasAttribute('disabled'))->toBe(! $running);
+
+    $component->call('backupNow', ...($componentClass === Index::class ? ['database', $backup->uuid] : []));
+    if ($running) {
+        Queue::assertPushed(DatabaseBackupJob::class);
+    } else {
+        $component->assertDispatched('error')->assertNotDispatched('success')->assertNoRedirect();
+        Queue::assertNotPushed(DatabaseBackupJob::class);
+    }
+})->with('database backup controls')->with([
+    ['running:healthy', true],
+    ['running:unhealthy', true],
+    ['exited:unhealthy', false],
+    ['restarting:unhealthy', false],
+]);
+
+it('checks current database status before queuing from a stale page', function (string $componentClass, string $type) {
+    $database = $this->databases[$type];
+    $database->update(['status' => 'running:healthy']);
+    $backup = $this->backups[$type]->fresh();
+    $parameters = $componentClass === Index::class
+        ? ['service' => $this->service]
+        : ['backup' => $backup, ...($componentClass === BackupEdit::class ? ['availableS3Storages' => collect()] : [])];
+    $component = Livewire::test($componentClass, $parameters);
+    $database->update(['status' => 'exited:unhealthy']);
+
+    $component->call('backupNow', ...($componentClass === Index::class ? ['database', $backup->uuid] : []))
+        ->assertDispatched('error')->assertNotDispatched('success')->assertNoRedirect();
+    Queue::assertNotPushed(DatabaseBackupJob::class);
+})->with('database backup controls');
+
+it('refreshes service backup buttons when the service status check completes', function () {
+    $database = $this->databases['service'];
+    $database->update(['status' => 'exited:unhealthy']);
+    $component = Livewire::test(Index::class, ['service' => $this->service]);
+    $database->update(['status' => 'running:healthy']);
+
+    $component->dispatch('echo-private:team.'.currentTeam()->id.',ServiceChecked');
+    expect($component->html())->not->toMatch('/<button\s+disabled[^>]*wire:click.stop="backupNow/s');
+
+    $database->update(['status' => 'exited:unhealthy']);
+    $component->dispatch('echo-private:team.'.currentTeam()->id.',ServiceChecked');
+    expect($component->html())->toMatch('/<button\s+disabled[^>]*wire:click.stop="backupNow/s');
+});
diff --git a/tests/Feature/ButtonDepthInteractionTest.php b/tests/Feature/ButtonDepthInteractionTest.php
new file mode 100644
index 0000000000..b2076f4fe4
--- /dev/null
+++ b/tests/Feature/ButtonDepthInteractionTest.php
@@ -0,0 +1,34 @@
+<?php
+
+test('standard buttons use raised hover and pressed depth states', function () {
+    $styles = file_get_contents(resource_path('css/app.css'));
+
+    expect($styles)
+        ->toContain('--button-depth-color: rgb(0 0 0 / 0.22);')
+        ->toContain('--button-depth: 0 2px 0 var(--button-depth-color);')
+        ->toContain('--button-depth-hover: 0 3px 0 var(--button-depth-color);')
+        ->toContain('.button-highlighted:not(:disabled)')
+        ->toContain('--button-depth-color: color-mix(in oklab, var(--color-coollabs) 52%, black);')
+        ->toContain('.dark .button:not(.button-highlighted):not(.button-error):not([isHighlighted]):not(:disabled)')
+        ->not->toContain('.dark .button:not(.button-highlighted):not([isHighlighted]):not(:disabled)')
+        ->toContain('--button-depth-color: rgb(255 255 255 / 0.08);')
+        ->not->toContain('.dark .button.button-highlighted:not(:disabled)')
+        ->toContain('.button.button-error:not(:disabled)')
+        ->toContain('--button-depth-color: var(--color-red-300);')
+        ->toContain('.dark .button.button-error:not(:disabled)')
+        ->toContain('--button-depth-color: var(--color-red-800);')
+        ->toContain('.button-error:not(:disabled)')
+        ->toContain('.button.button-error {')
+        ->toContain('.button.button-error:disabled {')
+        ->toContain('hover:bg-red-100 hover:text-red-900 dark:hover:bg-red-700 dark:hover:text-white')
+        ->not->toContain('hover:bg-red-300 hover:text-white dark:hover:bg-red-800')
+        ->not->toContain('button[isError]:not(:disabled)')
+        ->toContain('.button:not(:disabled):hover')
+        ->toContain('transform: translateY(-1px);')
+        ->toContain('transition-duration: 120ms, 120ms, 120ms, 80ms, 80ms;')
+        ->toContain('.button:not(:disabled):active')
+        ->toContain('transform: translateY(2px);')
+        ->not->toContain('transform: translateY(1px);')
+        ->not->toContain('transform: translateY(3px);')
+        ->toContain('box-shadow: none;');
+});
diff --git a/tests/Feature/ButtonTextCapitalizationTest.php b/tests/Feature/ButtonTextCapitalizationTest.php
new file mode 100644
index 0000000000..cdf41d1292
--- /dev/null
+++ b/tests/Feature/ButtonTextCapitalizationTest.php
@@ -0,0 +1,11 @@
+<?php
+
+test('standard buttons capitalize each word in their labels', function () {
+    $utilities = file_get_contents(resource_path('css/utilities.css'));
+
+    preg_match('/@utility button \{(?<styles>[\s\S]*?)\n\}/', $utilities, $matches);
+
+    expect($matches['styles'] ?? '')
+        ->toContain('capitalize')
+        ->not->toContain('normal-case');
+});
diff --git a/tests/Feature/CreateScheduledBackupValidationTest.php b/tests/Feature/CreateScheduledBackupValidationTest.php
index 1b18c31b41..a96e776a05 100644
--- a/tests/Feature/CreateScheduledBackupValidationTest.php
+++ b/tests/Feature/CreateScheduledBackupValidationTest.php
@@ -82,11 +82,10 @@ it('creates a service database backup without S3 and opens its configuration', f
 
     $backup = ScheduledDatabaseBackup::query()->sole();
 
-    $component->assertRedirectToRoute('project.service.database.backup.show', [
+    $component->assertRedirectToRoute('project.service.volume-backups.index', [
         'project_uuid' => $this->project->uuid,
         'environment_uuid' => $this->environment->uuid,
         'service_uuid' => $service->uuid,
-        'stack_service_uuid' => $database->uuid,
         'backup_uuid' => $backup->uuid,
     ]);
 
@@ -114,14 +113,22 @@ it('selects a service database when creating a backup from the unified backups p
         'custom_type' => 'postgresql',
     ]);
 
-    Livewire::test(CreateScheduledBackup::class, ['service' => $service])
+    $component = Livewire::test(CreateScheduledBackup::class, ['service' => $service])
         ->assertSee('Database')
         ->assertSee('analytics')
         ->set('selectedDatabaseUuid', $analytics->uuid)
         ->set('frequency', 'daily')
         ->call('submit');
 
-    expect(ScheduledDatabaseBackup::query()->sole()->database->is($analytics))->toBeTrue();
+    $backup = ScheduledDatabaseBackup::query()->sole();
+    expect($backup->database->is($analytics))->toBeTrue();
+
+    $component->assertRedirectToRoute('project.service.volume-backups.index', [
+        'project_uuid' => $this->project->uuid,
+        'environment_uuid' => $this->environment->uuid,
+        'service_uuid' => $service->uuid,
+        'backup_uuid' => $backup->uuid,
+    ]);
 });
 
 it('creates a clickhouse backup for its configured database', function () {
diff --git a/tests/Feature/CustomThemeContrastTest.php b/tests/Feature/CustomThemeContrastTest.php
new file mode 100644
index 0000000000..1f9050c842
--- /dev/null
+++ b/tests/Feature/CustomThemeContrastTest.php
@@ -0,0 +1,111 @@
+<?php
+
+/**
+ * The custom theme derives its whole palette from one user-picked color.
+ * These tests lock in two guarantees:
+ *  1. The pipeline is authored entirely in OKLCH (no hex color literals).
+ *  2. Foreground colors (accent text, placeholders) are clamped so they stay
+ *     readable on the dark surfaces regardless of the picked hue.
+ */
+function customThemeBlock(): string
+{
+    $css = file_get_contents(resource_path('css/app.css'));
+
+    return str($css)
+        ->after('html[data-theme="custom"] {')
+        ->before('}')
+        ->toString();
+}
+
+it('derives the custom theme entirely in oklch with no hex color literals', function () {
+    expect(customThemeBlock())
+        ->not->toMatch('/#[0-9a-fA-F]{3,8}\b/')
+        ->toContain('--theme-base-color:')
+        ->toContain('oklch(');
+});
+
+it('adds clamped, readable foreground tokens for the custom theme', function () {
+    $block = customThemeBlock();
+
+    expect($block)
+        // Accent text/icons on dark surfaces: lightness forced into a readable band.
+        ->toContain('--theme-fg-on-surface:')
+        ->toMatch('/--theme-fg-on-surface:\s*oklch\(from var\(--theme-base-color\)[^;]*clamp\(/')
+        // Placeholder: light, near-neutral, guaranteed readable.
+        ->toContain('--theme-placeholder-color:')
+        ->toMatch('/--theme-placeholder-color:\s*oklch\(from var\(--theme-base-color\)/');
+});
+
+it('routes custom-theme accent text utilities to the readable on-surface token', function () {
+    $css = file_get_contents(resource_path('css/app.css'));
+
+    expect($css)
+        ->toMatch('/\[class~="text-warning"\][^{]*\{\s*color:\s*var\(--theme-fg-on-surface\)/')
+        ->toContain('[class~="text-coollabs"]');
+});
+
+it('uses the clamped placeholder token for custom-theme inputs', function () {
+    $css = file_get_contents(resource_path('css/app.css'));
+
+    expect($css)
+        ->toMatch('/html\[data-theme="custom"\] input::placeholder[^}]*var\(--theme-placeholder-color\)/');
+});
+
+it('adds a light custom variant that tints surfaces toward white with dark foreground', function () {
+    $css = file_get_contents(resource_path('css/app.css'));
+
+    expect($css)
+        ->toContain('html[data-theme="custom"]:not(.dark)')
+        // Surfaces hold a fixed high lightness with injected base-hue chroma, so the
+        // tint is visible (not a washed-out mix into white).
+        ->toMatch('/html\[data-theme="custom"\]:not\(\.dark\)[^}]*--color-app:\s*oklch\(from var\(--theme-base-color\) 9[0-9](\.[0-9]+)?% min\(c,/s')
+        // Accent text/icons clamp to a dark, readable band on light surfaces.
+        ->toMatch('/html\[data-theme="custom"\]:not\(\.dark\)[^}]*--theme-fg-on-surface:\s*oklch\(from var\(--theme-base-color\) clamp\(0\.3/s');
+});
+
+it('lets the theme scripts toggle a custom light or dark mode via customMode', function () {
+    $base = file_get_contents(resource_path('views/layouts/base.blade.php'));
+    $component = file_get_contents(resource_path('views/components/theme-controls.blade.php'));
+    $picker = file_get_contents(resource_path('views/components/theme-controls/picker.blade.php'));
+    $appearance = file_get_contents(resource_path('views/livewire/profile/appearance.blade.php'));
+    $accountMenu = file_get_contents(resource_path('views/components/top-user-menu.blade.php'));
+
+    expect($base)
+        // One shared Alpine factory holds the theme logic.
+        ->toContain('window.themeControls')
+        ->toContain('localStorage.customMode')
+        ->toContain('setCustomMode')
+        // The picker no longer force-adds dark; it follows customMode.
+        ->not->toContain("document.documentElement.classList.add('dark')")
+        // Light/dark lives inside the custom color picker popover.
+        ->and($picker)
+        ->toContain('customMode')
+        ->toContain('setCustomMode')
+        ->toContain('type="color"')
+        ->and($component)
+        // Both variants open the shared picker popover for Custom.
+        ->toContain('<x-theme-controls.picker')
+        ->toContain('chooseCustom')
+        // Both the page and the dropdown reuse the one component.
+        ->and($appearance)
+        ->toContain('<x-theme-controls variant="full"')
+        ->and($accountMenu)
+        ->toContain('<x-theme-controls variant="menu"');
+});
+
+it('computes the theme base color and accent foreground in oklch, not hex', function () {
+    $base = file_get_contents(resource_path('views/layouts/base.blade.php'));
+
+    $accentFn = str($base)
+        ->after('window.themeAccentForeground')
+        ->before('window.applyStoredTheme')
+        ->toString();
+
+    expect($base)
+        ->toContain('window.hexToOklch')
+        ->and($accentFn)
+        ->toContain('oklch(0% 0 0)')
+        ->toContain('oklch(100% 0 0)')
+        ->not->toContain('#000000')
+        ->not->toContain('#ffffff');
+});
diff --git a/tests/Feature/DatabaseBackupUploadValidationTest.php b/tests/Feature/DatabaseBackupUploadValidationTest.php
index 88978eeaba..f8416fe6c7 100644
--- a/tests/Feature/DatabaseBackupUploadValidationTest.php
+++ b/tests/Feature/DatabaseBackupUploadValidationTest.php
@@ -220,16 +220,16 @@ test('file scanner allows ordinary gzipped dumps', function () {
     expect(DatabaseBackupFileValidator::fileContainsPostgresqlProgramExecution($gzClean))->toBeFalse();
 });
 
-test('file scanner detects program execution payloads inside custom format archives', function () {
+test('file scanner defers custom format archives to pg_restore inspection', function () {
     $archive = writeScanPayload("PGDMP\0binary COPY records FROM PROGRAM payload");
 
-    expect(DatabaseBackupFileValidator::fileContainsPostgresqlProgramExecution($archive))->toBeTrue();
+    expect(DatabaseBackupFileValidator::fileContainsPostgresqlProgramExecution($archive))->toBeFalse();
 });
 
-test('file scanner detects program execution payloads inside gzipped custom format archives', function () {
+test('file scanner defers gzipped custom format archives to pg_restore inspection', function () {
     $archive = writeScanPayload("PGDMP\0binary COPY records FROM PROGRAM payload", gzip: true);
 
-    expect(DatabaseBackupFileValidator::fileContainsPostgresqlProgramExecution($archive))->toBeTrue();
+    expect(DatabaseBackupFileValidator::fileContainsPostgresqlProgramExecution($archive))->toBeFalse();
 });
 
 test('file scanner allows custom format archives without program execution', function () {
diff --git a/tests/Feature/DockerComposeHttpPortsTest.php b/tests/Feature/DockerComposeHttpPortsTest.php
new file mode 100644
index 0000000000..6b3adaa935
--- /dev/null
+++ b/tests/Feature/DockerComposeHttpPortsTest.php
@@ -0,0 +1,19 @@
+<?php
+
+use Symfony\Component\Yaml\Yaml;
+
+it('selects only TCP container ports for HTTP routing and confirmation', function (array $service, array $expected) {
+    $compose = Yaml::dump(['services' => ['web' => $service]]);
+
+    expect(firstDockerComposeServicePort($service))->toBe($expected[0] ?? null)
+        ->and(dockerComposeServicePort($compose, 'web'))->toBe($expected[0] ?? null)
+        ->and(dockerComposeServicePorts($compose, 'web'))->toBe($expected);
+})->with([
+    'expose UDP first' => [['expose' => ['53/udp', '8080/tcp']], [8080]],
+    'published UDP first' => [['ports' => ['53:53/udp', '18080:8080/tcp']], [8080]],
+    'long syntax UDP first' => [['ports' => [['target' => 53, 'protocol' => 'udp'], ['target' => 8080, 'published' => 18080, 'protocol' => 'tcp']]], [8080]],
+    'implicit TCP' => [['expose' => [80], 'ports' => [['target' => 8080], '18081:8081']], [80, 8080, 8081]],
+    'UDP only' => [['expose' => ['53/udp'], 'ports' => [['target' => 67, 'protocol' => 'udp']]], []],
+    'other protocol' => [['ports' => ['9000:9000/sctp', '8080']], [8080]],
+    'duplicates' => [['expose' => ['8080/udp', '8080/tcp'], 'ports' => ['18080:8080']], [8080]],
+]);
diff --git a/tests/Feature/EnvironmentVariableEditorTest.php b/tests/Feature/EnvironmentVariableEditorTest.php
new file mode 100644
index 0000000000..20c25bb28b
--- /dev/null
+++ b/tests/Feature/EnvironmentVariableEditorTest.php
@@ -0,0 +1,49 @@
+<?php
+
+use App\Livewire\Project\Shared\EnvironmentVariable\Show;
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\EnvironmentVariable;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::forceCreate(['id' => 0]);
+    $this->user = User::factory()->create();
+    $team = Team::factory()->create();
+    $team->members()->attach($this->user, ['role' => 'owner']);
+    $project = Project::factory()->create(['team_id' => $team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+    $application = Application::factory()->create(['environment_id' => $environment->id]);
+    $this->environmentVariable = EnvironmentVariable::create([
+        'key' => 'TEST_VAR',
+        'value' => 'test_value',
+        'resourceable_type' => Application::class,
+        'resourceable_id' => $application->id,
+    ]);
+
+    $this->actingAs($this->user);
+});
+
+test('environment variable editor closes only after a successful update', function () {
+    Livewire::test(Show::class, ['env' => $this->environmentVariable, 'type' => 'application'])
+        ->set('comment', 'Updated in the editor')
+        ->call('submit')
+        ->assertHasNoErrors()
+        ->assertDispatched('environment-variable-updated', envId: $this->environmentVariable->id);
+});
+
+test('environment variable editor stays open when validation fails', function () {
+    Livewire::test(Show::class, ['env' => $this->environmentVariable, 'type' => 'application'])
+        ->set('valuesLoaded', true)
+        ->set('is_required', true)
+        ->set('value', '')
+        ->call('submit')
+        ->assertNotDispatched('environment-variable-updated');
+});
diff --git a/tests/Feature/EnvironmentVariableTableLayoutTest.php b/tests/Feature/EnvironmentVariableTableLayoutTest.php
index 7402fc350d..ce0086af22 100644
--- a/tests/Feature/EnvironmentVariableTableLayoutTest.php
+++ b/tests/Feature/EnvironmentVariableTableLayoutTest.php
@@ -149,3 +149,16 @@ test('environment variable toolbar does not use blade directives inside componen
         ->not->toMatch('/<x-table\.toolbar[^>]*@if/')
         ->toContain('aria-busy="{{ ! $readyToLoad ? \'true\' : \'false\' }}"');
 });
+
+test('environment variable editor places delete left and update actions right', function () {
+    $view = file_get_contents(resource_path('views/livewire/project/shared/environment-variable/show.blade.php'));
+
+    expect($view)
+        ->toContain('class="flex flex-wrap items-center justify-between gap-2 border-t')
+        ->toMatch('/data-environment-variable-delete-action[\s\S]+buttonTitle="Delete"[\s\S]+data-environment-variable-update-actions[\s\S]+Lock[\s\S]+Update variable/')
+        ->toContain('@environment-variable-updated.window="if ($event.detail.envId === @js($env->id)) modalOpen = false"')
+        ->toContain('<fieldset disabled wire:dirty.attr.remove="disabled">')
+        ->toContain('type="submit" isHighlighted wire:target="submit"')
+        ->toContain('wire:dirty.attr.remove="disabled"')
+        ->not->toContain('@click="modalOpen = false"');
+});
diff --git a/tests/Feature/FormsButtonLoadingTest.php b/tests/Feature/FormsButtonLoadingTest.php
index ba806a930f..f600458e82 100644
--- a/tests/Feature/FormsButtonLoadingTest.php
+++ b/tests/Feature/FormsButtonLoadingTest.php
@@ -2,6 +2,33 @@
 
 use Illuminate\Support\Facades\Blade;
 
+it('marks error buttons with the shared error class', function () {
+    $html = Blade::render('<x-forms.button isError>Delete service</x-forms.button>');
+
+    expect($html)
+        ->toContain('class="button button-error"')
+        ->not->toContain('isError');
+});
+
+it('keeps unavailable destructive actions styled as error buttons', function () {
+    $view = file_get_contents(resource_path('views/livewire/project/shared/danger.blade.php'));
+
+    expect($view)->toContain('<x-forms.button isError disabled tooltip="You do not have permission to delete this resource.">');
+});
+
+it('uses the shared error style for destructive form buttons', function (string $view, string $button) {
+    expect(file_get_contents(resource_path("views/{$view}")))->toContain($button);
+})->with([
+    'unavailable team deletion' => [
+        'livewire/team/danger-zone.blade.php',
+        '<x-forms.button isError disabled tooltip="Resolve the requirements shown before deleting this team.">',
+    ],
+    'tag removal' => [
+        'livewire/project/shared/tags.blade.php',
+        '<x-forms.button isError wire:click="deleteTag',
+    ],
+]);
+
 it('disables the button and targets the wire click action while loading', function () {
     $html = Blade::render(
         '<x-forms.button wire:click.prevent="checkConnection"><x-reicon name="refresh" class="size-3.5" />Check connection</x-forms.button>'
diff --git a/tests/Feature/GithubPullRequestWebhookRoutingTest.php b/tests/Feature/GithubPullRequestWebhookRoutingTest.php
new file mode 100644
index 0000000000..7768dbd903
--- /dev/null
+++ b/tests/Feature/GithubPullRequestWebhookRoutingTest.php
@@ -0,0 +1,156 @@
+<?php
+
+use App\Jobs\ProcessGithubPullRequestWebhook;
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\GithubApp;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\Team;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Queue;
+
+uses(RefreshDatabase::class);
+
+function createGithubPullRequestWebhookApplication(array $overrides = []): Application
+{
+    $team = Team::factory()->create();
+    $project = Project::factory()->create(['team_id' => $team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+    $server = Server::factory()->create(['team_id' => $team->id]);
+    $server->settings->update([
+        'is_reachable' => true,
+        'is_usable' => true,
+        'force_disabled' => false,
+    ]);
+    $destination = $server->standaloneDockers()->firstOrFail();
+
+    return Application::create(array_merge([
+        'name' => 'github-pr-webhook-app',
+        'git_repository' => 'https://github.com/test-org/test-repo',
+        'git_branch' => 'main',
+        'build_pack' => 'nixpacks',
+        'ports_exposes' => '3000',
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+    ], $overrides));
+}
+
+function githubPullRequestPayload(string $action, string $baseBranch): array
+{
+    return [
+        'action' => $action,
+        'number' => 42,
+        'repository' => [
+            'id' => 987654321,
+            'full_name' => 'test-org/test-repo',
+        ],
+        'pull_request' => [
+            'html_url' => 'https://github.com/test-org/test-repo/pull/42',
+            'title' => 'Stacked change',
+            'author_association' => 'OWNER',
+            'head' => [
+                'ref' => 'feature/child',
+                'sha' => 'head-sha',
+            ],
+            'base' => [
+                'ref' => $baseBranch,
+            ],
+        ],
+    ];
+}
+
+it('routes a closed GitHub App pull request to its application after the base branch changes', function () {
+    Queue::fake();
+
+    $team = Team::factory()->create();
+    $githubApp = GithubApp::create([
+        'name' => 'github-app-webhook-test',
+        'api_url' => 'https://api.github.com',
+        'html_url' => 'https://github.com',
+        'app_id' => 1234567890,
+        'webhook_secret' => 'test-secret',
+        'is_public' => false,
+        'team_id' => $team->id,
+    ]);
+    $application = createGithubPullRequestWebhookApplication([
+        'repository_project_id' => 987654321,
+        'source_id' => $githubApp->id,
+        'source_type' => GithubApp::class,
+    ]);
+
+    $body = json_encode(githubPullRequestPayload('closed', 'feature/parent'), JSON_THROW_ON_ERROR);
+    $response = $this->call('POST', '/webhooks/source/github/events', [], [], [], [
+        'HTTP_X-GitHub-Event' => 'pull_request',
+        'HTTP_X-GitHub-Hook-Installation-Target-Id' => '1234567890',
+        'HTTP_X-Hub-Signature-256' => 'sha256='.hash_hmac('sha256', $body, 'test-secret'),
+        'CONTENT_TYPE' => 'application/json',
+    ], $body);
+
+    $response->assertOk();
+    expect($response->getContent())->toContain('PR webhook received');
+    Queue::assertPushed(ProcessGithubPullRequestWebhook::class, fn (ProcessGithubPullRequestWebhook $job): bool => $job->applicationId === $application->id
+        && $job->action === 'closed'
+        && $job->pullRequestId === 42);
+});
+
+it('routes a closed manual pull request to its application after the base branch changes', function () {
+    Queue::fake();
+
+    $application = createGithubPullRequestWebhookApplication();
+    $payload = githubPullRequestPayload('closed', 'feature/parent');
+    $body = json_encode($payload, JSON_THROW_ON_ERROR);
+
+    $response = $this->call('POST', '/webhooks/source/github/events/manual', [], [], [], [
+        'HTTP_X-GitHub-Event' => 'pull_request',
+        'HTTP_X-Hub-Signature-256' => 'sha256='.hash_hmac('sha256', $body, $application->manual_webhook_secret_github),
+        'CONTENT_TYPE' => 'application/json',
+    ], $body);
+
+    $response->assertOk();
+    Queue::assertPushed(ProcessGithubPullRequestWebhook::class, fn (ProcessGithubPullRequestWebhook $job): bool => $job->applicationId === $application->id
+        && $job->action === 'closed'
+        && $job->pullRequestId === 42);
+});
+
+it('continues to filter non-closed pull requests by base branch', function (string $endpoint) {
+    Queue::fake();
+
+    if ($endpoint === 'app') {
+        $team = Team::factory()->create();
+        $githubApp = GithubApp::create([
+            'name' => 'github-app-webhook-test',
+            'api_url' => 'https://api.github.com',
+            'html_url' => 'https://github.com',
+            'app_id' => 1234567890,
+            'webhook_secret' => 'test-secret',
+            'is_public' => false,
+            'team_id' => $team->id,
+        ]);
+        createGithubPullRequestWebhookApplication([
+            'repository_project_id' => 987654321,
+            'source_id' => $githubApp->id,
+            'source_type' => GithubApp::class,
+        ]);
+
+        $body = json_encode(githubPullRequestPayload('opened', 'feature/parent'), JSON_THROW_ON_ERROR);
+        $response = $this->call('POST', '/webhooks/source/github/events', [], [], [], [
+            'HTTP_X-GitHub-Event' => 'pull_request',
+            'HTTP_X-GitHub-Hook-Installation-Target-Id' => '1234567890',
+            'HTTP_X-Hub-Signature-256' => 'sha256='.hash_hmac('sha256', $body, 'test-secret'),
+            'CONTENT_TYPE' => 'application/json',
+        ], $body);
+    } else {
+        $application = createGithubPullRequestWebhookApplication();
+        $body = json_encode(githubPullRequestPayload('opened', 'feature/parent'), JSON_THROW_ON_ERROR);
+        $response = $this->call('POST', '/webhooks/source/github/events/manual', [], [], [], [
+            'HTTP_X-GitHub-Event' => 'pull_request',
+            'HTTP_X-Hub-Signature-256' => 'sha256='.hash_hmac('sha256', $body, $application->manual_webhook_secret_github),
+            'CONTENT_TYPE' => 'application/json',
+        ], $body);
+    }
+
+    $response->assertOk();
+    Queue::assertNotPushed(ProcessGithubPullRequestWebhook::class);
+})->with(['app', 'manual']);
diff --git a/tests/Feature/LegacyServiceRoutingPortTest.php b/tests/Feature/LegacyServiceRoutingPortTest.php
new file mode 100644
index 0000000000..41f0e17179
--- /dev/null
+++ b/tests/Feature/LegacyServiceRoutingPortTest.php
@@ -0,0 +1,94 @@
+<?php
+
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\Service;
+use App\Models\ServiceApplication;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Symfony\Component\Yaml\Yaml;
+
+uses(RefreshDatabase::class);
+
+it('only preserves an unambiguous saved upstream for the same legacy container', function (array $labels, ?int $expected, array $rawChanges = [], array $savedChanges = [], ?string $type = null) {
+    $raw = array_replace(['image' => 'httpd:2.4-alpine', 'environment' => ['SERVICE_URL_WEB']], $rawChanges);
+    $saved = array_replace(['image' => 'httpd:2.4-alpine', 'labels' => $labels], $savedChanges);
+    $service = new Service;
+    $service->forceFill([
+        'service_type' => $type,
+        'docker_compose_raw' => Yaml::dump(['services' => ['web' => $raw]]),
+        'docker_compose' => Yaml::dump(['services' => ['web' => $saved, 'other' => ['image' => 'httpd:2.4-alpine', 'labels' => ['traefik.http.services.other.loadbalancer.server.port=9000']]]]),
+    ]);
+    $application = new ServiceApplication(['name' => 'web']);
+    $application->setRelation('service', $service);
+
+    expect($application->getRequiredPort())->toBe($expected);
+})->with([
+    'Traefik list' => [['traefik.http.services.web.loadbalancer.server.port=3000'], 3000],
+    'Traefik map' => [['traefik.http.services.web.loadbalancer.server.port' => '3000'], 3000],
+    'Caddy list' => [['caddy_0.handle_path.0_reverse_proxy={{upstreams 3000}}'], 3000],
+    'Caddy map' => [['caddy_0.handle_path.0_reverse_proxy' => '{{upstreams 3000}}'], 3000],
+    'matching proxies' => [['traefik.http.services.web.loadbalancer.server.port=3000', 'caddy_0.handle_path.0_reverse_proxy={{upstreams 3000}}'], 3000],
+    'conflicting proxies' => [['traefik.http.services.web.loadbalancer.server.port=3000', 'caddy_0.handle_path.0_reverse_proxy={{upstreams 4000}}'], null],
+    'multiple Traefik ports' => [['traefik.http.services.web.loadbalancer.server.port=3000', 'traefik.http.services.api.loadbalancer.server.port=4000'], null],
+    'malformed port' => [['traefik.http.services.web.loadbalancer.server.port=3000oops'], null],
+    'out of range' => [['traefik.http.services.web.loadbalancer.server.port=65536'], null],
+    'negative' => [['traefik.http.services.web.loadbalancer.server.port=-1'], null],
+    'mixed malformed' => [['traefik.http.services.web.loadbalancer.server.port=3000', 'caddy_0.handle_path.0_reverse_proxy=oops'], null],
+    'map bare FQDN' => [['traefik.http.services.web.loadbalancer.server.port=3000'], 3000, ['environment' => ['SERVICE_FQDN_WEB' => null]]],
+    'UDP only preserves HTTP upstream' => [['traefik.http.services.web.loadbalancer.server.port=3000'], 3000, ['expose' => ['53/udp']]],
+    'zero' => [['traefik.http.services.web.loadbalancer.server.port=0'], null],
+    'malformed Caddy' => [['caddy_0.handle_path.0_reverse_proxy={{upstreams 3000oops}}'], null],
+    'discovery Caddy' => [['caddy_0.handle_path.0_reverse_proxy={{upstreams}}'], null],
+    'no cross container' => [[], null],
+    'changed image' => [['traefik.http.services.web.loadbalancer.server.port=3000'], null, [], ['image' => 'httpd:latest']],
+    'missing saved image' => [['traefik.http.services.web.loadbalancer.server.port=3000'], null, [], ['image' => null]],
+    'no direct declaration' => [['traefik.http.services.web.loadbalancer.server.port=3000'], null, ['environment' => ['URL=${SERVICE_URL_WEB}']]],
+    'explicit magic wins' => [['traefik.http.services.web.loadbalancer.server.port=3000'], 8080, ['environment' => ['SERVICE_URL_WEB_8080']]],
+    'Compose port wins' => [['traefik.http.services.web.loadbalancer.server.port=3000'], 8080, ['expose' => [8080]]],
+    'known template excluded' => [['traefik.http.services.web.loadbalancer.server.port=3000'], 80, [], [], 'wordpress-without-database'],
+]);
+
+it('preserves legacy upstreams across repeated parsing without adding public ports', function (int $version, ?int $override) {
+    InstanceSettings::forceCreate(['id' => 0]);
+    $team = Team::factory()->create();
+    $server = Server::factory()->create(['team_id' => $team->id]);
+    $server->settings->update(['generate_exact_labels' => false]);
+    $destination = StandaloneDocker::where('server_id', $server->id)->first()
+        ?? StandaloneDocker::factory()->create(['server_id' => $server->id]);
+    $project = Project::factory()->create(['team_id' => $team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+    $service = Service::factory()->create([
+        'name' => 'legacy-stack',
+        'service_type' => null,
+        'environment_id' => $environment->id,
+        'server_id' => $server->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+        'docker_compose_raw' => "services:\n  web:\n    image: httpd:2.4-alpine\n    environment:\n      - SERVICE_URL_WEB\n",
+        'docker_compose' => Yaml::dump(['services' => ['web' => ['image' => 'httpd:2.4-alpine', 'labels' => ['traefik.http.services.web.loadbalancer.server.port=3000']]]]),
+        'compose_parsing_version' => (string) $version,
+    ]);
+    ServiceApplication::create([
+        'name' => 'web',
+        'service_id' => $service->id,
+        'image' => 'httpd:2.4-alpine',
+        'fqdn' => 'https://legacy.example.com',
+        'domain_port_overrides' => $override === null ? null : ['https://legacy.example.com' => $override],
+    ]);
+
+    for ($iteration = 0; $iteration < 2; $iteration++) {
+        $parsed = $service->fresh()->parse();
+        $labels = collect($parsed['services']['web']['labels']);
+        $ports = $labels->filter(fn ($label) => str_contains($label, '.loadbalancer.server.port='));
+        expect($ports)->not->toBeEmpty();
+        foreach ($ports as $port) {
+            expect($port)->toEndWith('='.($override ?? 3000));
+        }
+        expect($labels->filter(fn ($label) => str_contains($label, 'reverse_proxy'))->implode(' '))->toContain('{{upstreams '.($override ?? 3000).'}}');
+        expect($service->fresh()->applications()->first()->fqdn)->toBe('https://legacy.example.com');
+    }
+})->with([4, 5])->with([null, 8080]);
diff --git a/tests/Feature/ListboxTriggerTruncationTest.php b/tests/Feature/ListboxTriggerTruncationTest.php
index 82e526bb3b..a7cd462954 100644
--- a/tests/Feature/ListboxTriggerTruncationTest.php
+++ b/tests/Feature/ListboxTriggerTruncationTest.php
@@ -78,6 +78,13 @@ test('portaled listboxes measure content without inheriting the viewport width',
         ->toContain('Math.max(triggerRect.width, panel.offsetWidth)');
 });
 
+test('portaled listboxes stay anchored when a scroll container moves', function () {
+    $listbox = file_get_contents(resource_path('views/components/forms/listbox.blade.php'));
+
+    expect($listbox)
+        ->toContain('@scroll.window.capture="open && positionPanel()"');
+});
+
 test('searchable listbox component uses shared trigger label truncation', function () {
     $html = Blade::render(<<<'BLADE'
         <x-forms.searchable-listbox id="tz" label="Timezone"
diff --git a/tests/Feature/Livewire/SentinelLogsTest.php b/tests/Feature/Livewire/SentinelLogsTest.php
new file mode 100644
index 0000000000..99d2fa1051
--- /dev/null
+++ b/tests/Feature/Livewire/SentinelLogsTest.php
@@ -0,0 +1,127 @@
+<?php
+
+use App\Actions\Server\StartSentinel;
+use App\Livewire\Project\Shared\GetLogs;
+use App\Livewire\Server\Sentinel\Logs;
+use App\Models\InstanceSettings;
+use App\Models\Server;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Auth\Access\AuthorizationException;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::create(['id' => 0]);
+    $team = Team::factory()->create();
+    $user = User::factory()->create();
+    $team->members()->attach($user->id, ['role' => 'owner']);
+    session(['currentTeam' => $team]);
+    $this->actingAs($user);
+    $this->server = Server::factory()->create(['team_id' => $team->id]);
+});
+
+it('does not show sync status or fetch logs when sentinel is disabled', function (bool $recentHeartbeat) {
+    $this->server->sentinelHeartbeat(isReset: ! $recentHeartbeat);
+    $this->server->settings()->update(['is_sentinel_enabled' => false, 'is_metrics_enabled' => false]);
+
+    Livewire::withQueryParams(['server_uuid' => $this->server->uuid])
+        ->test(Logs::class)
+        ->assertSee('Sentinel is disabled')
+        ->assertSeeHtml('wire:click="enableSentinel"')
+        ->assertDontSee('Out of sync')
+        ->assertDontSee('In sync')
+        ->assertDontSeeLivewire(GetLogs::class);
+})->with([false, true]);
+
+it('shows sync status and logs when sentinel is enabled', function (bool $metricsOnly, bool $recentHeartbeat) {
+    $this->server->sentinelHeartbeat(isReset: ! $recentHeartbeat);
+    $this->server->settings()->update([
+        'is_sentinel_enabled' => ! $metricsOnly,
+        'is_metrics_enabled' => $metricsOnly,
+        'is_build_server' => false,
+    ]);
+
+    Livewire::withQueryParams(['server_uuid' => $this->server->uuid])
+        ->test(Logs::class)
+        ->assertDontSee('Sentinel is disabled')
+        ->assertSee($recentHeartbeat ? 'In sync' : 'Out of sync')
+        ->assertSeeLivewire(GetLogs::class);
+})->with([false, true])->with([false, true]);
+
+it('enables sentinel from the logs page', function () {
+    $this->server->settings()->update(['is_sentinel_enabled' => false, 'is_metrics_enabled' => false]);
+    StartSentinel::shouldRun()->once()->withArgs(function (Server $server, bool $restart): bool {
+        expect($server->id)->toBe($this->server->id);
+        expect($restart)->toBeTrue();
+        $server->settings->update(['is_sentinel_enabled' => true]);
+
+        return true;
+    });
+
+    Livewire::withQueryParams(['server_uuid' => $this->server->uuid])
+        ->test(Logs::class)
+        ->call('enableSentinel')
+        ->assertDontSee('Sentinel is disabled')
+        ->assertDontSee('Enable Sentinel')
+        ->assertSeeLivewire(GetLogs::class)
+        ->assertDispatched('refreshServerShow')
+        ->assertDispatched('success');
+
+    expect($this->server->fresh()->isSentinelEnabled())->toBeTrue();
+});
+
+it('keeps sentinel disabled when startup fails', function () {
+    $this->server->settings()->update(['is_sentinel_enabled' => false, 'is_metrics_enabled' => false]);
+    StartSentinel::shouldRun()->once()->andThrow(new RuntimeException('Startup failed'));
+
+    Livewire::withQueryParams(['server_uuid' => $this->server->uuid])
+        ->test(Logs::class)
+        ->call('enableSentinel')
+        ->assertSee('Sentinel is disabled')
+        ->assertDontSeeLivewire(GetLogs::class)
+        ->assertDispatched('error')
+        ->assertNotDispatched('success');
+
+    expect($this->server->fresh()->isSentinelEnabled())->toBeFalse();
+});
+
+it('does not enable sentinel on unsupported servers', function (string $setting) {
+    $this->server->settings()->update(['is_sentinel_enabled' => false, 'is_metrics_enabled' => false, $setting => true]);
+    StartSentinel::shouldRun()->never();
+
+    Livewire::withQueryParams(['server_uuid' => $this->server->uuid])
+        ->test(Logs::class)
+        ->call('enableSentinel')
+        ->assertSee('Sentinel is disabled')
+        ->assertDispatched('error');
+})->with(['is_build_server', 'is_swarm_manager', 'is_swarm_worker']);
+
+it('denies enabling sentinel to members and users outside the server team', function (bool $crossTeam) {
+    $this->server->settings()->update(['is_sentinel_enabled' => false, 'is_metrics_enabled' => false]);
+    $user = User::factory()->create();
+    if (! $crossTeam) {
+        $this->server->team->members()->attach($user->id, ['role' => 'member']);
+    }
+    $this->actingAs($user);
+    StartSentinel::shouldRun()->never();
+    $component = new Logs;
+    $component->server = $this->server->fresh();
+
+    expect(fn () => $component->enableSentinel())
+        ->toThrow(AuthorizationException::class);
+    expect($this->server->fresh()->isSentinelEnabled())->toBeFalse();
+})->with([false, true]);
+
+it('does not restart sentinel when it is already enabled', function () {
+    $this->server->settings()->update(['is_sentinel_enabled' => true, 'is_build_server' => false]);
+    StartSentinel::shouldRun()->never();
+
+    Livewire::withQueryParams(['server_uuid' => $this->server->uuid])
+        ->test(Logs::class)
+        ->assertSeeLivewire(GetLogs::class)
+        ->call('enableSentinel')
+        ->assertNotDispatched('success');
+});
diff --git a/tests/Feature/MissingDatabaseBackupNotificationTest.php b/tests/Feature/MissingDatabaseBackupNotificationTest.php
new file mode 100644
index 0000000000..f4f2efd191
--- /dev/null
+++ b/tests/Feature/MissingDatabaseBackupNotificationTest.php
@@ -0,0 +1,126 @@
+<?php
+
+use App\Jobs\CheckMissingDatabaseBackupsJob;
+use App\Models\ScheduledDatabaseBackup;
+use App\Models\ScheduledDatabaseBackupExecution;
+use App\Models\Team;
+use App\Notifications\Database\BackupMissing;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Carbon;
+use Illuminate\Support\Facades\Notification;
+
+uses(RefreshDatabase::class);
+
+afterEach(fn () => Carbon::setTestNow());
+
+function missingBackupSchedule(Team $team, array $attributes = []): ScheduledDatabaseBackup
+{
+    $backup = ScheduledDatabaseBackup::create(array_merge([
+        'enabled' => true,
+        'frequency' => '0 0 * * *',
+        'save_s3' => false,
+        'database_type' => 'App\\Models\\StandalonePostgresql',
+        'database_id' => 999,
+        'team_id' => $team->id,
+        'missing_backup_notification_days' => 2,
+    ], $attributes));
+
+    ScheduledDatabaseBackup::whereKey($backup->id)->update(['created_at' => now()->subDays(3)]);
+
+    return $backup->refresh();
+}
+
+function teamWithBackupFailureNotifications(): Team
+{
+    $team = Team::create(['name' => 'Test team']);
+    $team->emailNotificationSettings->update([
+        'smtp_enabled' => true,
+        'backup_failure_email_notifications' => true,
+    ]);
+
+    return $team;
+}
+
+it('notifies the team when an enabled backup has no executions for the configured days', function () {
+    Notification::fake();
+    $team = teamWithBackupFailureNotifications();
+    $backup = missingBackupSchedule($team);
+
+    (new CheckMissingDatabaseBackupsJob)->handle();
+
+    Notification::assertSentTo($team, BackupMissing::class, fn (BackupMissing $notification) => $notification->backup->is($backup));
+    expect($backup->fresh()->missing_backup_notification_sent_at)->not->toBeNull();
+});
+
+it('does not notify for recent disabled or unconfigured backup schedules', function () {
+    Notification::fake();
+    $team = teamWithBackupFailureNotifications();
+    missingBackupSchedule($team, ['enabled' => false]);
+    missingBackupSchedule($team, ['missing_backup_notification_days' => 0]);
+    $recent = missingBackupSchedule($team);
+    ScheduledDatabaseBackup::whereKey($recent->id)->update(['created_at' => now()->subDay()]);
+
+    (new CheckMissingDatabaseBackupsJob)->handle();
+
+    Notification::assertNothingSent();
+});
+
+it('notifies once per period without executions and rearms after another execution', function () {
+    Notification::fake();
+    $team = teamWithBackupFailureNotifications();
+    $backup = missingBackupSchedule($team);
+
+    (new CheckMissingDatabaseBackupsJob)->handle();
+    (new CheckMissingDatabaseBackupsJob)->handle();
+
+    Notification::assertSentToTimes($team, BackupMissing::class, 1);
+
+    Carbon::setTestNow(now()->addMinute());
+    $execution = ScheduledDatabaseBackupExecution::create([
+        'scheduled_database_backup_id' => $backup->id,
+        'status' => 'success',
+        'database_name' => 'app',
+    ]);
+    Carbon::setTestNow(now()->addDays(3));
+
+    (new CheckMissingDatabaseBackupsJob)->handle();
+
+    Notification::assertSentToTimes($team, BackupMissing::class, 2);
+});
+
+it('preserves the last execution checkpoint when execution history is deleted', function () {
+    Notification::fake();
+    $team = teamWithBackupFailureNotifications();
+    $backup = missingBackupSchedule($team);
+
+    (new CheckMissingDatabaseBackupsJob)->handle();
+    Carbon::setTestNow(now()->addMinute());
+    $execution = ScheduledDatabaseBackupExecution::create([
+        'scheduled_database_backup_id' => $backup->id,
+        'status' => 'success',
+        'database_name' => 'app',
+    ]);
+    $execution->delete();
+    Carbon::setTestNow(now()->addDays(3));
+
+    (new CheckMissingDatabaseBackupsJob)->handle();
+
+    Notification::assertSentToTimes($team, BackupMissing::class, 2);
+});
+
+it('waits to mark an incident sent until a notification channel is enabled', function () {
+    Notification::fake();
+    $team = Team::create(['name' => 'Test team']);
+    $backup = missingBackupSchedule($team);
+
+    (new CheckMissingDatabaseBackupsJob)->handle();
+    expect($backup->fresh()->missing_backup_notification_sent_at)->toBeNull();
+
+    $team->emailNotificationSettings->update([
+        'smtp_enabled' => true,
+        'backup_failure_email_notifications' => true,
+    ]);
+    (new CheckMissingDatabaseBackupsJob)->handle();
+
+    Notification::assertSentTo($team, BackupMissing::class);
+});
diff --git a/tests/Feature/ModalScrollLockTest.php b/tests/Feature/ModalScrollLockTest.php
index 17d293519d..18d69d20a6 100644
--- a/tests/Feature/ModalScrollLockTest.php
+++ b/tests/Feature/ModalScrollLockTest.php
@@ -1,5 +1,22 @@
 <?php
 
+use Illuminate\Support\Facades\Blade;
+
+test('input modal renders without requiring a modal id', function () {
+    $html = Blade::render('<x-modal-input>Modal content</x-modal-input>');
+
+    expect($html)->toContain('Modal content');
+});
+
+test('input modal overlay is fixed to the viewport without its own page scrollbar', function () {
+    $html = Blade::render('<x-modal-input>Modal content</x-modal-input>');
+
+    expect($html)
+        ->toContain('class="fixed inset-0 z-99 overflow-hidden"')
+        ->not->toContain('w-screen overflow-hidden')
+        ->not->toContain('class="fixed inset-0 z-99 overflow-y-auto"');
+});
+
 test('confirmation modal closes before dispatching an event that can open another modal', function () {
     $modal = file_get_contents(resource_path('views/components/modal-confirmation.blade.php'));
 
diff --git a/tests/Feature/ModelFillableCreationTest.php b/tests/Feature/ModelFillableCreationTest.php
index 46d9c36daa..1e06ea22d3 100644
--- a/tests/Feature/ModelFillableCreationTest.php
+++ b/tests/Feature/ModelFillableCreationTest.php
@@ -1047,14 +1047,15 @@ it('creates ScheduledTaskExecution with all fillable attributes', function () {
         'finished_at' => now()->toISOString(),
         'started_at' => now()->subMinute()->toISOString(),
         'retry_count' => 0,
-        'duration' => 60,
+        'duration' => '60.25',
         'error_details' => null,
     ]);
 
     expect($execution->exists)->toBeTrue();
     expect($execution->scheduled_task_id)->toBe($task->id);
     expect($execution->status)->toBe('success');
-    expect((float) $execution->duration)->toBe(60.0);
+    expect($execution->duration)->toBe(60.25);
+    expect($execution->toArray()['duration'])->toBe(60.25);
     expect($execution->retry_count)->toBe(0);
 });
 
diff --git a/tests/Feature/PersistentStorageVolumesLayoutTest.php b/tests/Feature/PersistentStorageVolumesLayoutTest.php
index f3938b87ff..91dcab3d26 100644
--- a/tests/Feature/PersistentStorageVolumesLayoutTest.php
+++ b/tests/Feature/PersistentStorageVolumesLayoutTest.php
@@ -211,11 +211,79 @@ it('renders volumes as a data table with shared column headers', function () {
         ->toContain('12rem')
         ->not->toContain('17.5rem');
 
+    expect($allView)
+        ->toContain("'table-badge', 'table-badge-success' => \$hasS3Backup")
+        ->not->toContain('<path stroke-linecap="round" stroke-linejoin="round" d="m4.5 12.75 6 6 9-13.5" />');
+
+    expect($css)->toMatch('/@media \(max-width: 768px\)[\s\S]*?\.volumes-col-backup\s*\{[^}]*flex-direction:\s*row;[^}]*align-items:\s*center;/');
+
     // Settings form labels are 13px (not Tailwind text-sm 14px).
     expect($css)
         ->toMatch('/\.application-settings-form label\s*\{[^}]*font-size:\s*13px/s');
 });
 
+it('renders volume actions and PR suffix controls as valid markup', function () {
+    [$application] = createApplicationWithVolume();
+    LocalPersistentVolume::create([
+        'uuid' => (string) Str::uuid(),
+        'name' => $application->uuid.'-cache',
+        'mount_path' => '/cache',
+        'resource_id' => $application->id,
+        'resource_type' => $application->getMorphClass(),
+        'is_preview_suffix_enabled' => true,
+    ]);
+
+    $html = Livewire::test(All::class, ['resource' => $application])->html();
+    $document = new DOMDocument;
+    $previousState = libxml_use_internal_errors(true);
+    $loaded = $document->loadHTML($html);
+    libxml_clear_errors();
+    libxml_use_internal_errors($previousState);
+    $xpath = new DOMXPath($document);
+    $helperText = 'Adds -pr-N to the storage name or path so each preview uses isolated data. Disabling it shares production data with previews.';
+
+    expect($loaded)->toBeTrue()
+        ->and($xpath->query("//*[contains(concat(' ', normalize-space(@class), ' '), ' volumes-col-actions ')]//button[normalize-space(.)='Backup']"))->toHaveCount(2)
+        ->and($xpath->query("//*[contains(concat(' ', normalize-space(@class), ' '), ' volumes-col-actions ')]//button[normalize-space(.)='Backup']//svg"))->toHaveCount(0)
+        ->and($xpath->query("//button[@aria-label='More information']/following-sibling::*[@role='tooltip'][contains(normalize-space(.), '{$helperText}')]"))->toHaveCount(3)
+        ->and($xpath->query("//template[@x-teleport='body']/*[@role='listbox']"))->toHaveCount(2);
+});
+
+it('declares explicit authorization on the changed storage controls', function () {
+    $view = file_get_contents(resource_path('views/livewire/project/shared/storages/all.blade.php'));
+
+    preg_match(
+        '/<x-forms\.listbox\s+id="forms\.\{\{ \$id \}\}\.isPreviewSuffixEnabled"[\s\S]*?\/>/',
+        $view,
+        $previewSuffixListbox
+    );
+
+    expect($previewSuffixListbox[0] ?? '')
+        ->toContain('canGate="update"')
+        ->toContain(':canResource="$resource"');
+
+    preg_match_all('/<x-forms\.button\b[^>]*>\s*Backup\s*<\/x-forms\.button>/s', $view, $backupButtons);
+
+    expect($backupButtons[0])->toHaveCount(3);
+
+    foreach ($backupButtons[0] as $backupButton) {
+        expect($backupButton)
+            ->toContain('canGate="update"')
+            ->toContain(':canResource="$resource"');
+    }
+});
+
+it('uses valid block wrappers around PR suffix helpers', function () {
+    $view = file_get_contents(resource_path('views/livewire/project/shared/storages/all.blade.php'));
+
+    expect($view)
+        ->not->toContain('<span class="volumes-col-pr flex items-center gap-1.5">')
+        ->not->toContain('<span class="volumes-mobile-label volumes-field-label flex items-center gap-1.5">');
+
+    expect(substr_count($view, '<x-helper helper="Adds -pr-N to the storage name or path so each preview uses isolated data. Disabling it shares production data with previews." />'))
+        ->toBe(3);
+});
+
 it('creates and exposes volume backups for service storage', function () {
     $service = Service::factory()->create([
         'environment_id' => $this->environment->id,
diff --git a/tests/Feature/PreviewDomainPortOverridesTest.php b/tests/Feature/PreviewDomainPortOverridesTest.php
index b40193cb29..b8825353b0 100644
--- a/tests/Feature/PreviewDomainPortOverridesTest.php
+++ b/tests/Feature/PreviewDomainPortOverridesTest.php
@@ -235,7 +235,7 @@ it('prunes a preview domain port override when removing the domain', function ()
         ->toBe(['https://two-preview.example.com' => 3000]);
 });
 
-it('shows an error badge when a preview domain has no internal port and ports exposes is empty', function () {
+it('shows a warning when a preview domain has no internal port and ports exposes is empty', function () {
     $this->application->update([
         'ports_exposes' => null,
     ]);
@@ -246,8 +246,9 @@ it('shows an error badge when a preview domain has no internal port and ports ex
     ]);
 
     Livewire::test(PreviewDomains::class, ['preview' => $preview])
-        ->assertSee('No internal port')
-        ->assertDontSee('Internal port');
+        ->assertSee('aria-label="No internal port"', false)
+        ->assertSee('Set Ports Exposes or a per-domain internal port')
+        ->assertDontSee('aria-label="Internal port ', false);
 });
 
 it('rejects adding a preview domain whose portless URL is already configured', function () {
@@ -269,7 +270,7 @@ it('rejects adding a preview domain whose portless URL is already configured', f
 it('saves compose preview domain port overrides per service without putting the port in the public URL', function () {
     $this->application->update([
         'build_pack' => 'dockercompose',
-        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n  api:\n    image: nginx:alpine\n",
+        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n    expose: [8080]\n  api:\n    image: nginx:alpine\n    expose: [3000]\n",
         'docker_compose_domains' => null,
     ]);
 
@@ -537,7 +538,7 @@ YAML,
         ->toBeFalse();
 });
 
-it('uses ports_exposes as the compose preview fallback when a domain has no override', function () {
+it('leaves single-service compose preview ports to proxy discovery when a domain has no override', function () {
     $this->application->update([
         'build_pack' => 'dockercompose',
         'compose_parsing_version' => '3',
@@ -565,9 +566,9 @@ YAML,
     $parsedCompose = applicationParser($this->application->fresh(), 118, $preview->id);
     $labels = collect(data_get($parsedCompose, 'services.frontend-pr-118.labels'));
 
-    expect($labels->contains(fn (string $label): bool => str_ends_with($label, '.loadbalancer.server.port=4000')))
-        ->toBeTrue()
-        ->and($labels->contains(fn (string $label): bool => str_contains($label, 'reverse_proxy={{upstreams 4000}}')))
+    expect($labels->contains(fn (string $label): bool => str_contains($label, '.loadbalancer.server.port=')))
+        ->toBeFalse()
+        ->and($labels->contains(fn (string $label): bool => str_contains($label, 'reverse_proxy={{upstreams}}')))
         ->toBeTrue();
 });
 
@@ -672,3 +673,305 @@ it('does not warn when re-saving a preview domain with the same custom port', fu
         ->assertSet('showPortWarningModal', false)
         ->assertDispatched('success');
 });
+
+it('checks compose preview ports against the selected service when saving domains', function (string $action, int $port, bool $warn) {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'ports_exposes' => '3000',
+        'docker_compose_raw' => <<<'YAML'
+services:
+  web:
+    image: nginx:alpine
+    expose:
+      - 8080
+      - 8081
+    ports:
+      - target: 8082
+        published: 18082
+      - "18083:8083"
+  api:
+    image: nginx:alpine
+    expose:
+      - 9090
+YAML,
+        'docker_compose_domains' => json_encode([
+            'web' => ['domain' => 'https://existing.example.com'],
+            'api' => ['domain' => 'https://api.example.com:9090'],
+        ]),
+    ]);
+    $preview = createPreviewForPortTests($this->application, 130, [
+        'docker_compose_domains' => json_encode(['web' => ['domain' => 'https://existing.example.com']]),
+        'fqdn' => 'https://existing.example.com',
+    ]);
+
+    $component = Livewire::test(PreviewDomains::class, ['preview' => $preview]);
+    if ($action === 'add') {
+        $component->set('newDomainService', 'web')
+            ->set('newDomainParts.host', 'new.example.com')
+            ->set('newDomainParts.port', (string) $port)
+            ->call('addDomain');
+        $domain = 'https://new.example.com';
+    } else {
+        $component->call('startEdit', 0)
+            ->set('editingDomainParts.port', (string) $port)
+            ->call('updateDomain');
+        $domain = 'https://existing.example.com';
+    }
+
+    $component->assertHasNoErrors()->assertSet('showPortWarningModal', $warn);
+
+    if ($warn) {
+        expect($preview->fresh()->domain_port_overrides ?? [])->not->toHaveKey($domain);
+        $component->assertSet('unrecognizedPort', $port)
+            ->call('confirmUseUnknownPort')
+            ->assertSet('showPortWarningModal', false);
+    }
+
+    $component->assertDispatched('success');
+    expect($preview->fresh()->domain_port_overrides[$domain] ?? null)->toBe($port);
+})->with(['add', 'edit'])->with([
+    'first exposed port' => [8080, false],
+    'second exposed port' => [8081, false],
+    'long syntax target' => [8082, false],
+    'short syntax target' => [8083, false],
+    'global port' => [3000, true],
+    'another service port' => [9090, true],
+    'published host port' => [18082, true],
+]);
+
+it('keeps an existing custom compose preview port without another warning', function () {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'ports_exposes' => '3000',
+        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n    expose: [8080]\n",
+        'docker_compose_domains' => json_encode(['web' => ['domain' => 'https://existing.example.com:7070']]),
+    ]);
+    $preview = createPreviewForPortTests($this->application, 131, [
+        'docker_compose_domains' => json_encode(['web' => ['domain' => 'https://existing.example.com:7070']]),
+        'fqdn' => 'https://existing.example.com:7070',
+    ]);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->call('startEdit', 0)
+        ->assertSet('editingDomainParts.port', '7070')
+        ->call('updateDomain')
+        ->assertHasNoErrors()
+        ->assertSet('showPortWarningModal', false)
+        ->assertDispatched('success');
+
+    expect($preview->fresh()->domain_port_overrides['https://existing.example.com'] ?? null)->toBe(7070);
+});
+
+it('keeps the selected preview domain identity across polling refreshes', function (bool $compose) {
+    $first = 'https://first-preview.example.com';
+    $second = 'https://second-preview.example.com';
+    if ($compose) {
+        $this->application->update([
+            'build_pack' => 'dockercompose',
+            'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n  api:\n    image: nginx:alpine\n",
+        ]);
+    }
+    $preview = createPreviewForPortTests($this->application, 140, $compose ? [
+        'docker_compose_domains' => json_encode(['web' => ['domain' => $first], 'api' => ['domain' => $first]]),
+    ] : ['fqdn' => "$first,$second"]);
+    $component = Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->call('startEdit', 0)
+        ->set('editingDomainParts.host', 'renamed-preview.example.com');
+
+    $preview->update($compose ? [
+        'docker_compose_domains' => json_encode(['api' => ['domain' => $first], 'web' => ['domain' => $first]]),
+    ] : ['fqdn' => "$second,$first"]);
+
+    $component->call('pollDnsChecks')
+        ->assertSet('editingIndex', 1)
+        ->assertSet('editingDomainParts.host', 'renamed-preview.example.com')
+        ->call('updateDomain')
+        ->assertHasNoErrors();
+
+    $preview->refresh();
+    if ($compose) {
+        expect(json_decode($preview->docker_compose_domains, true))
+            ->toMatchArray(['web' => ['domain' => 'https://renamed-preview.example.com'], 'api' => ['domain' => $first]]);
+    } else {
+        expect($preview->fqdn)->toBe("$second,https://renamed-preview.example.com");
+    }
+})->with([false, true]);
+
+it('keeps the selected preview domain when deleting an earlier row', function () {
+    $preview = createPreviewForPortTests($this->application, 141, [
+        'fqdn' => 'https://first-preview.example.com,https://second-preview.example.com',
+    ]);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->call('startEdit', 1)
+        ->call('removeDomainByKey', hash('sha256', 'https://first-preview.example.com|'))
+        ->assertSet('editingIndex', 0)
+        ->set('editingDomainParts.host', 'renamed-preview.example.com')
+        ->call('updateDomain')
+        ->assertHasNoErrors();
+
+    expect($preview->fresh()->fqdn)->toBe('https://renamed-preview.example.com');
+});
+
+it('clears the selected preview domain when it is deleted', function () {
+    $preview = createPreviewForPortTests($this->application, 142, [
+        'fqdn' => 'https://first-preview.example.com,https://second-preview.example.com',
+    ]);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->call('startEdit', 0)
+        ->call('removeDomain', 0)
+        ->assertSet('editingIndex', null)
+        ->assertDispatched('close-preview-domain-edit', previewId: $preview->id)
+        ->set('editingDomainParts.host', 'wrong-preview.example.com')
+        ->call('updateDomain');
+
+    expect($preview->fresh()->fqdn)->toBe('https://second-preview.example.com');
+});
+
+it('scopes preview domain modal events to their preview', function () {
+    $preview = createPreviewForPortTests($this->application, 143, ['fqdn' => 'https://preview.example.com']);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->call('startEdit', 0)
+        ->assertDispatched('open-preview-domain-edit', previewId: $preview->id)
+        ->set('editingDomainParts.host', 'renamed-preview.example.com')
+        ->call('updateDomain')
+        ->assertDispatched('close-preview-domain-edit', previewId: $preview->id)
+        ->set('newDomainParts.host', 'another-preview.example.com')
+        ->call('addDomain')
+        ->assertDispatched('close-preview-domain-add', previewId: $preview->id)
+        ->assertNotDispatched('close-modal');
+});
+
+it('prevents members from opening editable preview domain settings', function () {
+    $preview = createPreviewForPortTests($this->application, 144, ['fqdn' => 'https://preview.example.com']);
+    $this->team->members()->updateExistingPivot($this->user->id, ['role' => 'member']);
+    $this->actingAs($this->user->fresh());
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->assertSuccessful()
+        ->call('startEdit', 0)
+        ->assertForbidden();
+});
+
+it('prevents reading preview domains from another team', function () {
+    $preview = createPreviewForPortTests($this->application, 145, ['fqdn' => 'https://private-preview.example.com']);
+    $otherTeam = Team::factory()->create();
+    $otherUser = User::factory()->create();
+    $otherTeam->members()->attach($otherUser->id, ['role' => 'owner']);
+    $this->actingAs($otherUser);
+    session(['currentTeam' => $otherTeam]);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])->assertForbidden();
+});
+
+it('rechecks preview view permission before polling domains', function () {
+    $preview = createPreviewForPortTests($this->application, 146, ['fqdn' => 'https://private-preview.example.com']);
+    $component = Livewire::test(PreviewDomains::class, ['preview' => $preview]);
+    $this->team->members()->detach($this->user->id);
+    $this->actingAs($this->user->fresh());
+
+    $component->call('pollDnsChecks')->assertForbidden();
+});
+
+it('reports the readonly preview redirect policy used by proxy labels', function (int $parserVersion, string $expectedRedirect) {
+    $compose = $parserVersion > 0;
+    $this->application->update(array_merge(['redirect' => 'www'], $compose ? [
+        'build_pack' => 'dockercompose',
+        'compose_parsing_version' => (string) $parserVersion,
+        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n    expose: [3000]\n",
+        'docker_compose_domains' => json_encode(['web' => ['domain' => 'https://production.example.com', 'redirect' => 'www']]),
+    ] : []));
+    $previewDomain = $expectedRedirect === 'non-www' ? 'https://www.preview.example.com' : 'https://preview.example.com';
+    $preview = createPreviewForPortTests($this->application, 147, array_merge([
+        'fqdn' => $previewDomain,
+    ], $compose ? [
+        'docker_compose_domains' => json_encode(['web' => [
+            'domain' => $previewDomain,
+            'redirect' => 'non-www',
+        ]]),
+    ] : []));
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->assertSet('domainRows.0.redirect', $expectedRedirect);
+
+    $labels = $compose
+        ? collect(data_get($this->application->fresh()->parse(147, $preview->id), 'services.web-pr-147.labels'))->implode("\n")
+        : implode("\n", generateLabelsApplication($this->application->fresh(), $preview->fresh()));
+    expect($labels)->toContain('X-Robots-Tag=noindex, nofollow');
+    if ($expectedRedirect === 'both') {
+        expect($labels)->not->toContain('.redirectregex.');
+    } else {
+        expect($labels)->toContain('.redirectregex.');
+    }
+})->with([
+    'normal previews ignore the production redirect' => [0, 'both'],
+    'legacy compose previews use the production redirect' => [2, 'www'],
+    'current compose previews use their own stored redirect' => [3, 'non-www'],
+]);
+
+it('clears the previous preview address validation error when opening another domain', function () {
+    $preview = createPreviewForPortTests($this->application, 148, [
+        'fqdn' => 'https://first-preview.example.com,https://second-preview.example.com',
+    ]);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->call('startEdit', 0)
+        ->set('editingDomainParts.host', 'not a hostname')
+        ->call('updateDomain')
+        ->assertHasErrors('editingDomainParts.host')
+        ->call('startEdit', 1)
+        ->assertHasNoErrors('editingDomainParts.host');
+});
+
+it('inherits preview HTTPS redirect policy while always preventing indexing', function (bool $compose, bool $forceHttps) {
+    if ($compose) {
+        $this->application->update([
+            'build_pack' => 'dockercompose',
+            'compose_parsing_version' => '3',
+            'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n    expose: [3000]\n",
+            'docker_compose_domains' => json_encode(['web' => ['domain' => 'https://production.example.com']]),
+        ]);
+    }
+    $this->application->settings()->update(['is_force_https_enabled' => $forceHttps]);
+    $preview = createPreviewForPortTests($this->application, 149, array_merge([
+        'fqdn' => 'https://preview.example.com',
+    ], $compose ? [
+        'docker_compose_domains' => json_encode(['web' => ['domain' => 'https://preview.example.com']]),
+    ] : []));
+
+    $labels = $compose
+        ? collect(data_get($this->application->fresh()->parse(149, $preview->id), 'services.web-pr-149.labels'))->implode("\n")
+        : implode("\n", generateLabelsApplication($this->application->fresh(), $preview->fresh()));
+
+    expect($labels)->toContain('X-Robots-Tag=noindex, nofollow');
+    expect((bool) preg_match('/\.middlewares=[^\n]*redirect-to-https/', $labels))->toBe($forceHttps);
+})->with([false, true])->with([false, true]);
+
+it('preserves readonly compose preview redirects when saving an address', function () {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'compose_parsing_version' => '3',
+        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n  api:\n    image: nginx:alpine\n",
+    ]);
+    $preview = createPreviewForPortTests($this->application, 150, [
+        'docker_compose_domains' => json_encode([
+            'web' => ['domain' => 'https://www.preview.example.com', 'redirect' => 'non-www'],
+            'api' => ['domain' => '', 'redirect' => 'www'],
+        ]),
+    ]);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->assertSet('domainRows.0.redirect', 'non-www')
+        ->call('startEdit', 0)
+        ->set('editingDomainParts.host', 'www.renamed-preview.example.com')
+        ->call('updateDomain')
+        ->assertHasNoErrors()
+        ->assertSet('domainRows.0.redirect', 'non-www');
+
+    expect(json_decode($preview->fresh()->docker_compose_domains, true))->toBe([
+        'web' => ['domain' => 'https://www.renamed-preview.example.com', 'redirect' => 'non-www'],
+        'api' => ['domain' => '', 'redirect' => 'www'],
+    ]);
+});
diff --git a/tests/Feature/ProfileAvatarTest.php b/tests/Feature/ProfileAvatarTest.php
index 68ced553d5..3512fccea3 100644
--- a/tests/Feature/ProfileAvatarTest.php
+++ b/tests/Feature/ProfileAvatarTest.php
@@ -72,11 +72,14 @@ it('serves the authenticated users profile picture', function () {
     $this->withoutMiddleware()->actingAs($user)
         ->get(route('profile.avatar'))
         ->assertSuccessful()
-        ->assertHeader('content-type', 'image/jpeg');
+        ->assertHeader('content-type', 'image/jpeg')
+        ->assertHeader('cache-control', 'immutable, max-age=31536000, private');
 });
 
 it('loads an S3 profile picture from the configured CDN', function () {
-    config()->set('constants.coolify.avatar_cdn_url', 'https://avatars.example.com/media/');
+    InstanceSettings::findOrFail(0)->update([
+        'image_cdn_url' => 'https://avatars.example.com/media',
+    ]);
     Team::factory()->create(['id' => 0]);
     $storage = S3Storage::query()->create([
         'team_id' => 0,
@@ -98,7 +101,6 @@ it('loads an S3 profile picture from the configured CDN', function () {
 });
 
 it('loads an S3 profile picture directly from S3 when the CDN is not configured', function () {
-    config()->set('constants.coolify.avatar_cdn_url');
     Team::factory()->create(['id' => 0]);
     $storage = S3Storage::query()->create([
         'team_id' => 0,
@@ -120,7 +122,6 @@ it('loads an S3 profile picture directly from S3 when the CDN is not configured'
 });
 
 it('does not use an unrelated S3 storage URL for a profile picture', function () {
-    config()->set('constants.coolify.avatar_cdn_url', 'https://avatars.example.com');
     $storage = S3Storage::query()->create([
         'team_id' => Team::factory()->create()->id,
         'name' => 'Unrelated storage',
diff --git a/tests/Feature/ProjectIconTest.php b/tests/Feature/ProjectIconTest.php
index fc03c9f30e..99a6c0ac5b 100644
--- a/tests/Feature/ProjectIconTest.php
+++ b/tests/Feature/ProjectIconTest.php
@@ -61,7 +61,8 @@ it('serves a project icon only to a member of its team', function () {
 
     $this->withoutMiddleware()->get(route('project.icon', ['project_uuid' => $this->project->uuid]))
         ->assertSuccessful()
-        ->assertHeader('content-type', 'image/jpeg');
+        ->assertHeader('content-type', 'image/jpeg')
+        ->assertHeader('cache-control', 'immutable, max-age=31536000, private');
 
     $otherUser = User::factory()->create();
     $otherTeam = Team::factory()->create();
@@ -104,7 +105,9 @@ it('exposes the icon URL on the projects index', function () {
 });
 
 it('loads an S3 project icon from the configured CDN', function () {
-    config()->set('constants.coolify.avatar_cdn_url', 'https://avatars.example.com/media/');
+    InstanceSettings::findOrFail(0)->update([
+        'image_cdn_url' => 'https://avatars.example.com/media',
+    ]);
     Team::factory()->create(['id' => 0]);
     $storage = S3Storage::query()->create([
         'team_id' => 0,
@@ -127,7 +130,6 @@ it('loads an S3 project icon from the configured CDN', function () {
 });
 
 it('loads an S3 project icon directly from S3 when the CDN is not configured', function () {
-    config()->set('constants.coolify.avatar_cdn_url');
     Team::factory()->create(['id' => 0]);
     $storage = S3Storage::query()->create([
         'team_id' => 0,
@@ -149,7 +151,6 @@ it('loads an S3 project icon directly from S3 when the CDN is not configured', f
 });
 
 it('does not use an unusable S3 storage URL for a project icon', function () {
-    config()->set('constants.coolify.avatar_cdn_url', 'https://avatars.example.com');
     Team::factory()->create(['id' => 0]);
     $storage = S3Storage::query()->create([
         'team_id' => 0,
diff --git a/tests/Feature/RealtimeTerminalPackagingTest.php b/tests/Feature/RealtimeTerminalPackagingTest.php
index 85191bc25e..4b400b49a6 100644
--- a/tests/Feature/RealtimeTerminalPackagingTest.php
+++ b/tests/Feature/RealtimeTerminalPackagingTest.php
@@ -180,8 +180,8 @@ it('uses the redesigned terminal canvas and controls on resource terminal pages'
 
     expect($view)
         ->toContain('data-terminal-session-canvas')
-        ->toContain('terminal-session-toolbar absolute top-3 right-3 left-3')
-        ->toContain('terminal-session-panel mt-8')
+        ->toContain('terminal-session-toolbar flex items-center gap-3 text-white select-none')
+        ->toContain('terminal-session-panel flex min-h-0 flex-1 flex-col overflow-hidden p-3 sm:p-6')
         ->toContain('<x-terminal.theme-selector')
         ->not->toContain('application-console-header flex h-[30px]');
 });
diff --git a/tests/Feature/ResourceHeadingUnifiedNavbarTest.php b/tests/Feature/ResourceHeadingUnifiedNavbarTest.php
index f7951e93a0..74d7fc1aac 100644
--- a/tests/Feature/ResourceHeadingUnifiedNavbarTest.php
+++ b/tests/Feature/ResourceHeadingUnifiedNavbarTest.php
@@ -519,14 +519,13 @@ it('builds application sidebar routes independently of the current request route
         ->toContain("'application_uuid' => \$application->uuid");
 });
 
-it('keeps the deployment log sidebar fixed in the layout without a top gap', function () {
+it('welds the deployment log sidebar to the main sidebar', function () {
     $deployment = file_get_contents(resource_path('views/livewire/project/application/deployment/show.blade.php'));
     $css = file_get_contents(resource_path('css/app.css'));
 
-    expect($deployment)->toContain(':flush="true"')
-        ->and($css)->toContain('.application-settings-navigation.is-flush')
-        ->and($css)->toContain('position: static;')
-        ->and($css)->toContain('overflow: visible;');
+    expect($deployment)->not->toContain(':flush="true"')
+        ->and($css)->toContain('left: var(--sidebar-w, 14rem);')
+        ->and($css)->toContain('position: fixed;');
 });
 
 it('uses the same mobile heading gap on deployment pages as application settings', function () {
diff --git a/tests/Feature/ServerResourcesPaginationTest.php b/tests/Feature/ServerResourcesPaginationTest.php
new file mode 100644
index 0000000000..0f9efaae40
--- /dev/null
+++ b/tests/Feature/ServerResourcesPaginationTest.php
@@ -0,0 +1,141 @@
+<?php
+
+use App\Livewire\Server\Resources;
+use App\Models\Server;
+
+beforeEach(function () {
+    $this->component = new Resources;
+    $this->component->server = Mockery::mock(Server::class)->makePartial();
+});
+
+it('paginates sorted resources on both tabs', function (string $tab, string $nameKey) {
+    $rows = collect(range(23, 1))->map(fn (int $id) => [$nameKey => "Resource $id"]);
+    $this->component->activeTab = $tab;
+    if ($tab === 'managed') {
+        $this->component->server->shouldReceive('definedResources')->andReturn($rows);
+    } else {
+        $this->component->unmanagedContainers = $rows->all();
+    }
+
+    $page = $this->component->render()->getData()['resources'];
+    expect($page->total())->toBe(23)
+        ->and($page->count())->toBe(10)
+        ->and($page->pluck($nameKey)->all())->toBe(array_map(fn ($id) => "Resource $id", range(1, 10)));
+
+    $this->component->nextPage();
+    $page = $this->component->render()->getData()['resources'];
+    expect($page->currentPage())->toBe(2)->and($page->count())->toBe(10)
+        ->and($page->first()[$nameKey])->toBe('Resource 11');
+
+    $this->component->nextPage();
+    $page = $this->component->render()->getData()['resources'];
+    expect($page->count())->toBe(3)->and($page->first()[$nameKey])->toBe('Resource 21');
+
+    $this->component->previousPage();
+    expect($this->component->render()->getData()['resources']->currentPage())->toBe(2);
+})->with([['managed', 'name'], ['unmanaged', 'Names']]);
+
+it('resets pagination and search when switching tabs but preserves them on refresh', function () {
+    $this->component->server->shouldReceive('refresh')->andReturnSelf();
+    $this->component->server->shouldReceive('loadUnmanagedContainers')->andReturn(collect());
+    $this->component->setPage(3);
+    $this->component->search = 'managed resource';
+    $this->component->loadUnmanagedContainers();
+    expect($this->component->getPage())->toBe(1)
+        ->and($this->component->search)->toBe('');
+    $this->component->setPage(2);
+    $this->component->search = 'container';
+    $this->component->loadUnmanagedContainers();
+    expect($this->component->getPage())->toBe(2)
+        ->and($this->component->search)->toBe('container');
+    $this->component->loadManagedContainers();
+    expect($this->component->getPage())->toBe(1)
+        ->and($this->component->search)->toBe('');
+    $this->component->setPage(2);
+    $this->component->search = 'application';
+    $this->component->loadManagedContainers();
+    expect($this->component->getPage())->toBe(2)
+        ->and($this->component->search)->toBe('application');
+});
+
+it('clamps page size and resets the page', function (int $size, int $expected) {
+    $this->component->setPage(3);
+    $this->component->perPage = $size;
+    $this->component->updatedPerPage();
+    expect($this->component->perPage)->toBe($expected)
+        ->and($this->component->getPage())->toBe(1);
+})->with([[25, 25], [0, 1], [200, 100]]);
+
+it('clamps stale pages after resources disappear including an empty list', function (int $count, int $expectedPage) {
+    $this->component->activeTab = 'unmanaged';
+    $this->component->unmanagedContainers = array_fill(0, $count, ['Names' => 'Container']);
+    $this->component->setPage(9);
+    $page = $this->component->render()->getData()['resources'];
+    expect($page->currentPage())->toBe($expectedPage)
+        ->and($this->component->getPage())->toBe($expectedPage)
+        ->and($page->total())->toBe($count);
+})->with([[12, 2], [0, 1]]);
+
+it('renders shared pagination for both resource tabs with stable row identities', function () {
+    $view = file_get_contents(resource_path('views/livewire/server/resources.blade.php'));
+    expect($view)->toContain('<x-table-pagination')
+        ->toContain('<x-page-size-select')
+        ->toContain('previous-action="previousPage"')
+        ->toContain('next-action="nextPage"')
+        ->toContain('wire:key="managed-')
+        ->toContain('wire:key="unmanaged-')
+        ->not->toContain('$server->definedResources()');
+});
+
+it('searches names across all pages before pagination on both tabs', function (string $tab, string $nameKey) {
+    $rows = collect(range(1, 25))->map(fn (int $id) => [$nameKey => "Resource $id"]);
+    $this->component->activeTab = $tab;
+    if ($tab === 'managed') {
+        $this->component->server->shouldReceive('definedResources')->andReturn($rows);
+    } else {
+        $this->component->unmanagedContainers = $rows->all();
+    }
+
+    $this->component->setPage(3);
+    $this->component->search = '  RESOURCE 2  ';
+    $this->component->updatedSearch();
+    $page = $this->component->render()->getData()['resources'];
+    expect($page->currentPage())->toBe(1)
+        ->and($page->total())->toBe(7)
+        ->and($page->pluck($nameKey)->all())->toBe([
+            'Resource 2', 'Resource 20', 'Resource 21', 'Resource 22',
+            'Resource 23', 'Resource 24', 'Resource 25',
+        ]);
+
+    $this->component->search = 'missing';
+    $this->component->updatedSearch();
+    expect($this->component->render()->getData()['resources']->total())->toBe(0);
+
+    $this->component->search = '';
+    $this->component->updatedSearch();
+    $page = $this->component->render()->getData()['resources'];
+    expect($page->total())->toBe(25)->and($page->currentPage())->toBe(1);
+
+    $this->component->search = '   ';
+    expect($this->component->render()->getData()['resources']->total())->toBe(25);
+})->with([['managed', 'name'], ['unmanaged', 'Names']]);
+
+it('provides accessible live search and a distinct no-results message', function () {
+    $view = file_get_contents(resource_path('views/livewire/server/resources.blade.php'));
+
+    expect($view)->toContain('wire:model.live.debounce.300ms="search"')
+        ->toContain('aria-label="Search resources by name"')
+        ->toContain('aria-label="Clear search"')
+        ->toContain('No matching resources')
+        ->toContain('No matching containers');
+});
+
+it('shows search feedback and prevents interaction with stale results while searching', function () {
+    $view = file_get_contents(resource_path('views/livewire/server/resources.blade.php'));
+
+    expect($view)
+        ->toContain('<x-table.loading target="search" text="Searching resources..." />')
+        ->not->toContain('wire:loading.inline-flex wire:target="search"')
+        ->toContain('wire:loading.class="pointer-events-none opacity-40 blur-[2px]"')
+        ->toContain('wire:loading.attr="inert" wire:target="search"');
+});
diff --git a/tests/Feature/Service/EditDomainPortValidationTest.php b/tests/Feature/Service/EditDomainPortValidationTest.php
index 0d569574ff..29e1f0b339 100644
--- a/tests/Feature/Service/EditDomainPortValidationTest.php
+++ b/tests/Feature/Service/EditDomainPortValidationTest.php
@@ -48,6 +48,7 @@ beforeEach(function () {
     // Create service with a name that maps to a template with required port
     $this->service = Service::factory()->create([
         'name' => 'supabase-test123',
+        'service_type' => 'supabase',
         'server_id' => $this->server->id,
         'destination_id' => $this->destination->id,
         'destination_type' => $this->destination->getMorphClass(),
@@ -99,6 +100,67 @@ it('loads a persisted port override in the service application editor', function
         ->assertOk();
 });
 
+it('preserves a legacy embedded port when only the description changes', function () {
+    ServiceApplication::query()->whereKey($this->serviceApplication->id)->update([
+        'fqdn' => 'http://example.com:8080',
+        'domain_port_overrides' => null,
+    ]);
+
+    Livewire::test(Index::class, [
+        'serviceApplication' => $this->serviceApplication->fresh(),
+    ])
+        ->set('description', 'Updated description')
+        ->call('submitApplication')
+        ->assertHasNoErrors()
+        ->assertSet('showPortWarningModal', false)
+        ->assertSet('fqdn', 'http://example.com:8080');
+
+    expect($this->serviceApplication->fresh())
+        ->description->toBe('Updated description')
+        ->fqdn->toBe('http://example.com')
+        ->domain_port_overrides->toBe(['http://example.com' => 8080]);
+});
+
+it('loads a legacy embedded port in the domain editor', function () {
+    ServiceApplication::query()->whereKey($this->serviceApplication->id)->update([
+        'fqdn' => 'http://example.com:8080',
+        'domain_port_overrides' => null,
+    ]);
+
+    Livewire::test(EditDomain::class, ['applicationId' => $this->serviceApplication->id])
+        ->assertSet('fqdn', 'http://example.com:8080')
+        ->assertOk();
+});
+
+it('prefers a persisted override over a legacy embedded port', function () {
+    ServiceApplication::query()->whereKey($this->serviceApplication->id)->update([
+        'fqdn' => 'http://example.com:8080',
+        'domain_port_overrides' => json_encode(['http://example.com' => 3000]),
+    ]);
+
+    expect($this->serviceApplication->fresh()->url)->toBe('http://example.com:3000');
+});
+
+it('allows explicit removal of a legacy embedded port', function () {
+    ServiceApplication::query()->whereKey($this->serviceApplication->id)->update([
+        'fqdn' => 'http://example.com:8080',
+        'domain_port_overrides' => null,
+    ]);
+
+    Livewire::test(EditDomain::class, ['applicationId' => $this->serviceApplication->id])
+        ->set('fqdn', 'http://example.com')
+        ->call('submit')
+        ->assertSet('showPortWarningModal', true)
+        ->call('confirmRemovePort')
+        ->assertHasNoErrors()
+        ->assertSet('showPortWarningModal', false);
+
+    expect($this->serviceApplication->fresh())
+        ->fqdn->toBe('http://example.com')
+        ->url->toBe('http://example.com')
+        ->domain_port_overrides->toBeNull();
+});
+
 it('initializes route state when mounting a service application directly', function () {
     Livewire::test(Index::class, [
         'serviceApplication' => $this->serviceApplication,
diff --git a/tests/Feature/ServiceApplicationsApiTest.php b/tests/Feature/ServiceApplicationsApiTest.php
index d6c687fbc5..3d7309ee32 100644
--- a/tests/Feature/ServiceApplicationsApiTest.php
+++ b/tests/Feature/ServiceApplicationsApiTest.php
@@ -410,3 +410,36 @@ describe('GET /api/v1/services/{uuid}/applications/{app_uuid}/logs', function ()
         $response->assertJsonFragment(['message' => 'Server is not functional.']);
     });
 });
+
+it('applies UI domain validation to service API updates', function (string $target, string $url) {
+    $ctx = createServiceWithApplicationForApiTest($this);
+    $ctx->serviceApplication->update(['fqdn' => 'https://original.example.com']);
+    $isApplication = $target === 'application';
+    $path = $isApplication
+        ? "/api/v1/services/{$ctx->service->uuid}/applications/{$ctx->serviceApplication->uuid}"
+        : "/api/v1/services/{$ctx->service->uuid}";
+    $payload = $isApplication ? ['url' => $url] : ['urls' => [['name' => 'web', 'url' => $url]]];
+
+    $this->withToken($this->bearerToken)->patchJson($path, $payload)
+        ->assertUnprocessable()
+        ->assertJsonValidationErrors($isApplication ? 'url' : 'urls.0.url');
+
+    expect($ctx->serviceApplication->fresh()->fqdn)->toBe('https://original.example.com');
+})->with(['application', 'service'])->with([
+    'wildcard' => 'https://*.example.com',
+    'too long' => 'https://example.com/'.str_repeat('a', 2048),
+]);
+
+it('rejects oversized service domains before creating a service', function () {
+    $count = Service::count();
+
+    $this->withToken($this->bearerToken)->postJson('/api/v1/services', [
+        'project_uuid' => $this->project->uuid,
+        'environment_uuid' => $this->environment->uuid,
+        'server_uuid' => $this->server->uuid,
+        'docker_compose_raw' => base64_encode("services:\n  web:\n    image: nginx:alpine\n"),
+        'urls' => [['name' => 'web', 'url' => 'https://example.com/'.str_repeat('a', 2048)]],
+    ])->assertUnprocessable()->assertJsonValidationErrors('urls.0.url');
+
+    expect(Service::count())->toBe($count);
+});
diff --git a/tests/Feature/ServiceDatabaseVerticalNavigationTest.php b/tests/Feature/ServiceDatabaseVerticalNavigationTest.php
index bdb7b77a1b..97b383c899 100644
--- a/tests/Feature/ServiceDatabaseVerticalNavigationTest.php
+++ b/tests/Feature/ServiceDatabaseVerticalNavigationTest.php
@@ -209,6 +209,27 @@ it('loads every backup editor section when the modal opens and switches tabs loc
         ->not->toContain('wire:click="selectScheduleSection');
 });
 
+it('keeps the backup schedule modal height stable while switching sections', function () {
+    $modal = file_get_contents(resource_path('views/components/modal-input.blade.php'));
+    $index = file_get_contents(resource_path('views/livewire/project/service/volume-backup/index.blade.php'));
+
+    expect($index)->toContain('isLarge fixedHeight')
+        ->and($modal)
+        ->toContain("'sm:h-[40rem]' => \$fixedHeight");
+});
+
+it('shows S3 section descriptions from the title helper', function () {
+    $volumeS3 = file_get_contents(resource_path('views/livewire/project/shared/storages/volume-backups/s3.blade.php'));
+    $databaseS3 = file_get_contents(resource_path('views/livewire/project/database/backup-edit/s3.blade.php'));
+
+    foreach ([$volumeS3, $databaseS3] as $view) {
+        expect($view)
+            ->toContain('<x-application.settings-section title="S3 storage"')
+            ->not->toContain('<div class="application-settings-section-header">')
+            ->not->toContain('<h2>S3 storage</h2>');
+    }
+});
+
 it('adds a back up now action to every service backup schedule row', function () {
     $index = file_get_contents(resource_path('views/livewire/project/service/volume-backup/index.blade.php'));
     $styles = file_get_contents(resource_path('css/app.css'));
diff --git a/tests/Feature/ServiceDomainsTest.php b/tests/Feature/ServiceDomainsTest.php
index 4f825f8e24..da6701656f 100644
--- a/tests/Feature/ServiceDomainsTest.php
+++ b/tests/Feature/ServiceDomainsTest.php
@@ -12,6 +12,7 @@ use App\Models\StandaloneDocker;
 use App\Models\Team;
 use App\Models\User;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Cache;
 use Illuminate\Support\Facades\Queue;
 use Illuminate\Support\Str;
 use Livewire\Livewire;
@@ -20,6 +21,7 @@ uses(RefreshDatabase::class);
 
 beforeEach(function () {
     $this->withoutVite();
+    config()->set('app.maintenance.store', 'array');
 
     InstanceSettings::unguarded(fn () => InstanceSettings::updateOrCreate(
         ['id' => 0],
@@ -140,24 +142,22 @@ it('groups configured domains and shows redirect settings in the table', functio
 
     expect($html)
         ->toContain("service-domain-group-{$this->apiApp->id}")
-        ->toContain("id=\"service-domain-direction-{$this->apiApp->id}-0-trigger\"")
-        ->toContain("id=\"service-domain-indexing-{$this->apiApp->id}-0-trigger\"")
         ->toContain('src="https://api.example.com/favicon.ico"')
         ->toContain('class="relative size-4 shrink-0"')
         ->toContain('domain-favicon-fallback')
         ->toContain('class="invisible absolute inset-0 size-4 rounded-sm"')
         ->toContain('$el.previousElementSibling.classList.add(\'hidden\')')
         ->toContain('x-on:error="$el.remove()"')
-        ->toContain('class="min-w-0 flex-1 text-[13px]')
+        ->toContain('class="min-w-0 flex-1 truncate text-[13px]')
         ->toContain('class="listbox-trigger"')
-        ->toContain('application-settings-section-body is-flush mt-1 w-full scroll-mt-28 overflow-visible')
+        ->toContain('application-settings-section-body is-flush overflow-visible')
         ->toContain('dark:bg-white/[0.04]')
         ->toContain('<span>Domain</span>')
-        ->toContain('<span>DNS Check</span>')
+        ->toContain('<span>DNS status</span>')
         ->not->toContain('<span>Last checked</span>')
         ->not->toContain("service-domain-group-{$this->webApp->id}")
         ->and(substr_count($html, '2 domains'))->toBe(1)
-        ->and(strpos($html, '>API</span>'))->toBeLessThan(strpos($html, '<span>Domain</span>'))
+        ->and(substr_count($html, '<span>Domain</span>'))->toBe(1)
         ->and(substr_count($html, "id=\"service-domain-group-{$this->apiApp->id}\""))->toBe(1);
 });
 
@@ -194,16 +194,25 @@ it('hides the HTTP redirect control for HTTP-only service applications', functio
         ->assertDontSee('Redirect HTTP to HTTPS');
 });
 
-it('shows one redirect control for each www and non-www pair', function () {
-    $this->apiApp->update([
-        'fqdn' => 'https://api.example.com,https://www.api.example.com,https://admin.example.com,https://www.admin.example.com',
-    ]);
+it('opens address fields and service-wide redirects in the same settings dialog for every domain', function () {
+    $domains = ['https://api.example.com', 'https://www.api.example.com', 'https://admin.example.com', 'https://www.admin.example.com'];
+    $this->apiApp->update(['fqdn' => implode(',', $domains)]);
 
-    $html = Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
-        ->assertSuccessful()
-        ->html();
+    $component = Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])]);
 
-    expect(substr_count($html, 'this.$wire.updateServiceRedirect('))->toBe(2);
+    foreach ($domains as $index => $domain) {
+        $html = $component->call('startEdit', $index)
+            ->assertSet('editingDomain', $domain)
+            ->assertSee('Domain settings')
+            ->assertSee('Save changes')
+            ->assertDontSee('Save address')
+            ->assertSee('Search engine indexing')
+            ->assertSee('www redirect')
+            ->assertDontSee('Edit address and port')
+            ->html();
+
+        expect(substr_count($html, 'this.$wire.updateServiceRedirect('))->toBe(1);
+    }
 });
 
 it('uses segmented fields when adding and editing service domains', function () {
@@ -246,12 +255,12 @@ it('shows dns entries control next to Add', function () {
         ->assertSee('Manual records');
 });
 
-it('rotates the dns entries chevron while its dropdown is open', function () {
+it('exposes the dns entries dropdown expanded state', function () {
     $view = file_get_contents(resource_path('views/livewire/project/shared/cloudflare-autoconfigure.blade.php'));
 
     expect($view)
-        ->toContain('class="inline-flex transition-transform"')
-        ->toContain(':class="dnsEntriesOpen && \'rotate-180\'"');
+        ->toContain('x-bind:aria-expanded="dnsEntriesOpen"')
+        ->toContain('x-show="dnsEntriesOpen"');
 });
 
 it('lists dns entries for service hosts that still need dns', function () {
@@ -280,6 +289,24 @@ it('lists dns entries for service hosts that still need dns', function () {
         ->not->toContain('web.example.com');
 });
 
+it('does not use instance network addresses for service dns entries on a remote server', function () {
+    InstanceSettings::get()->update([
+        'public_ipv4' => '198.51.100.20',
+        'public_ipv6' => '2001:db8::20',
+    ]);
+    $this->apiApp->update(['fqdn' => 'https://api.example.com']);
+
+    $component = Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])]);
+
+    expect($component->instance()->dnsRecordHints())->toBe([
+        [
+            'type' => 'A',
+            'name' => 'api.example.com',
+            'value' => '203.0.113.10',
+        ],
+    ]);
+});
+
 it('persists a service redirect when its dropdown changes', function () {
     $this->webApp->update(['fqdn' => 'https://web.example.com', 'redirect' => 'both']);
 
@@ -400,7 +427,7 @@ it('keeps a stable key for the rendered domain list', function () {
 
     expect($view)
         ->toContain('wire:key="service-domains-list"')
-        ->toContain('wire:key="service-domain-rows-{{ $appId }}-{{ md5(serialize($rows->all())) }}"')
+        ->toContain('wire:key="service-domain-rows-{{ $appId }}"')
         ->not->toContain('md5(serialize($domainRows))');
 });
 
@@ -484,9 +511,9 @@ it('prunes the previous dns status when a service domain is renamed', function (
 
     Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
         ->call('startEdit', 0)
-        ->assertSee('Direction')
+        ->assertSee('www redirect')
         ->assertSee('Search engine indexing')
-        ->set('editingDomain', 'https://renamed.example.com')
+        ->set('editingDomainParts.host', 'renamed.example.com')
         ->call('updateDomain')
         ->assertHasNoErrors()
         ->assertDispatched('edit-domain-saved')
@@ -739,7 +766,8 @@ it('shows service dns mismatches before other domain entries', function () {
     Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
         ->assertSet('domainRows.0.url', 'https://broken.example.com')
         ->assertSet('domainRows.0.dns_status', 'failed')
-        ->assertSet('domainRows.2.url', 'https://healthy.example.com');
+        ->assertCount('domainRows', 2)
+        ->assertSet('domainRows.1.url', 'https://healthy.example.com');
 });
 
 it('hides dns message text when service domain dns status is ok', function () {
@@ -755,7 +783,7 @@ it('hides dns message text when service domain dns status is ok', function () {
     ]);
 
     Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
-        ->assertSee('DNS OK')
+        ->assertSee('DNS matches')
         ->assertDontSee('DNS points to 203.0.113.10');
 });
 
@@ -809,7 +837,8 @@ it('hides dns check controls from read-only users', function () {
     $this->team->members()->updateExistingPivot($this->user->id, ['role' => 'member']);
 
     Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
-        ->assertDontSee('Recheck DNS')
+        ->assertDontSee('Check all DNS')
+        ->assertDontSee('aria-label="Settings for', false)
         ->assertDontSee('Check DNS');
 });
 
@@ -828,10 +857,11 @@ it('exposes the stack domains route', function () {
 
 it('updates search engine indexing from the service domains view', function () {
     Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
+        ->call('startEdit', 0)
         ->assertSee('Noindex')
         ->assertSee('Indexable')
         ->assertSee('Search engine indexing')
-        ->assertSee('Direction')
+        ->assertSee('www redirect')
         ->assertSee('toggleNoindexDomain', false)
         ->assertSee('updateServiceRedirect', false)
         ->assertSee('wire:ignore', false)
@@ -913,3 +943,200 @@ it('does not show an internal port badge when the service has no env port', func
         ->assertDontSee('Internal port ')
         ->assertDontSee('table-badge-danger', false);
 });
+
+it('prioritizes public addresses and moves domain configuration behind settings', function () {
+    $this->apiApp->update(['fqdn' => 'https://api.example.com:8080']);
+
+    $html = Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
+        ->assertSee('Check all DNS')
+        ->assertSee('Add domain')
+        ->assertSee('Domain settings')
+        ->call('startEdit', 0)
+        ->assertSee('Indexing and redirect changes save automatically.')
+        ->assertSee('Internal port 8080')
+        ->assertSee('Both www and non-www')
+        ->assertSee('Search indexing allowed')
+        ->assertDontSee('Manage domains and www/non-www redirects')
+        ->html();
+
+    expect($html)->toContain('title="https://api.example.com"')
+        ->not->toContain('title="https://api.example.com:8080"');
+});
+
+it('distinguishes unchecked domains from dns checks in progress', function () {
+    InstanceSettings::find(0)->update(['is_dns_validation_enabled' => true]);
+    Cache::forget('instance_settings');
+
+    Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
+        ->assertSee('Not checked')
+        ->assertDontSee('DNS pending');
+});
+
+it('keeps the edited domain selected when settings refresh and reorder rows', function () {
+    $component = Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
+        ->call('startEdit', 0);
+
+    $this->webApp->update([
+        'fqdn' => 'https://broken.example.com',
+        'domain_dns_statuses' => [
+            'https://broken.example.com' => ['status' => 'failed', 'message' => 'Mismatch'],
+        ],
+    ]);
+
+    $component->call('refreshDomains')
+        ->assertSet('editingIndex', 1)
+        ->set('editingDomainParts.host', 'renamed.example.com')
+        ->call('updateDomain')
+        ->assertHasNoErrors();
+
+    expect($this->apiApp->fresh()->fqdn)->toBe('https://renamed.example.com')
+        ->and($this->webApp->fresh()->fqdn)->toBe('https://broken.example.com');
+});
+
+it('renders compact icon-only domain actions with accessible labels', function () {
+    $html = Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])->html();
+    $document = new DOMDocument;
+    @$document->loadHTML($html);
+    $xpath = new DOMXPath($document);
+
+    foreach (['Check DNS', 'Settings for https://api.example.com', 'Remove domain'] as $label) {
+        $buttons = $xpath->query('//button[@aria-label="'.$label.'"]');
+        expect($buttons->length)->toBe(1);
+        $button = $buttons->item(0);
+        expect(trim($button->textContent))->toBe('')
+            ->and($button->getAttribute('class'))->toContain('icon-button')
+            ->and($button->getAttribute('title'))->not->toBe('');
+    }
+
+    expect($html)->not->toContain('aria-label="More actions for');
+});
+
+it('uses the shared mobile domain summary layout', function () {
+    $view = file_get_contents(resource_path('views/livewire/project/service/partials/domain-table.blade.php'));
+
+    expect($view)
+        ->toContain('service-domain-mobile-summary')
+        ->toContain('Domain routing summary')
+        ->toContain('No redirects')
+        ->toContain('Noindex');
+});
+
+it('reuses the floating save bar for pending domain address edits', function () {
+    $view = file_get_contents(resource_path('views/livewire/project/service/domains.blade.php'));
+
+    expect($view)->toContain('<x-unsaved-bar action="updateDomain"')
+        ->toContain('dirty="hasAddressChanges"')
+        ->toContain('<template x-if="modalOpen">')
+        ->not->toContain('Save address');
+});
+
+it('inherits the counterpart internal port when enabling redirects without a port warning', function (?int $override, string $redirect) {
+    $this->service->update([
+        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n    environment:\n      - SERVICE_URL_WEB_80\n  api:\n    image: node:alpine\n",
+    ]);
+    $host = $redirect === 'www' ? 'web.example.com' : 'www.web.example.com';
+    $counterpart = $redirect === 'www' ? 'www.web.example.com' : 'web.example.com';
+    $url = "https://{$host}/blog";
+    $pairedUrl = "https://{$counterpart}/blog";
+    $this->webApp->update([
+        'fqdn' => $url,
+        'redirect' => 'both',
+        'domain_port_overrides' => $override === null ? null : [$url => $override],
+    ]);
+
+    Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
+        ->call('updateServiceRedirect', $this->webApp->id, $redirect)
+        ->assertHasNoErrors()
+        ->assertSet('showPortWarningModal', false)
+        ->assertSet('pendingAction', null)
+        ->assertDispatched('success', 'Redirect updated.')
+        ->call('refreshDomains')
+        ->assertSet("serviceRedirects.{$this->webApp->id}", $redirect);
+
+    $this->webApp->refresh();
+    expect($this->webApp->redirect)->toBe($redirect)
+        ->and($this->webApp->fqdn)->toContain($pairedUrl)
+        ->and($this->webApp->domain_port_overrides[$pairedUrl] ?? $this->webApp->getRequiredPort())->toBe($override ?? 80)
+        ->and($this->webApp->domain_port_overrides[$url] ?? null)->toBe($override);
+})->with([null, 80, 8080])->with(['www', 'non-www']);
+
+it('still warns and allows cancellation when manually adding a different port', function () {
+    $this->service->update([
+        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n    environment:\n      - SERVICE_FQDN_WEB_8000\n  api:\n    image: node:alpine\n",
+    ]);
+
+    Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
+        ->set('newServiceApplicationId', $this->webApp->id)
+        ->set('newDomain', 'https://web.example.com:3000')
+        ->call('addDomain')
+        ->assertSet('showPortWarningModal', true)
+        ->call('cancelRemovePort')
+        ->assertSet('showPortWarningModal', false)
+        ->assertSet('pendingAction', null)
+        ->call('addDomain')
+        ->assertSet('showPortWarningModal', true);
+
+    expect($this->webApp->fresh()->fqdn)->toBeNull();
+});
+
+it('still checks domain conflicts when inheriting a redirect counterpart port', function () {
+    $this->webApp->update([
+        'fqdn' => 'https://example.com',
+        'redirect' => 'both',
+        'domain_port_overrides' => ['https://example.com' => 8080],
+    ]);
+    $this->apiApp->update(['fqdn' => 'https://www.example.com']);
+
+    $component = Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
+        ->call('updateServiceRedirect', $this->webApp->id, 'www')
+        ->assertSet('showDomainConflictModal', true)
+        ->assertSet('showPortWarningModal', false);
+
+    expect($this->webApp->fresh()->redirect)->toBe('both');
+
+    $component->call('refreshDomains')
+        ->call('confirmDomainUsage')
+        ->assertSet('showDomainConflictModal', false)
+        ->assertSet('showPortWarningModal', false)
+        ->assertDispatched('success', 'Redirect updated.');
+
+    expect($this->webApp->fresh()->redirect)->toBe('www')
+        ->and($this->webApp->fresh()->domain_port_overrides['https://www.example.com'])->toBe(8080);
+});
+
+it('renders domain settings in compact columns instead of a second summary line', function () {
+    $html = Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])->html();
+    foreach (['Protocol redirect', 'Domain redirect', 'Internal port', 'Search indexing'] as $heading) {
+        expect($html)->toContain('<span>'.$heading.'</span>');
+    }
+    $view = file_get_contents(resource_path('views/livewire/project/service/partials/domain-table.blade.php'));
+    expect($view)->toContain('service-domain-detail')
+        ->not->toContain('gap-x-3 gap-y-1');
+});
+
+it('renders each domain table header below its service heading', function () {
+    $view = file_get_contents(resource_path('views/livewire/project/service/domains.blade.php'));
+    $serviceHeadingPosition = strpos($view, 'service-domain-group-{{ $appId }}');
+    $domainTablePosition = strpos($view, "'showHeader' => true");
+
+    expect($view)
+        ->not->toContain('<div class="data-table-header service-domains-overview-grid">')
+        ->and($serviceHeadingPosition)->not->toBeFalse()
+        ->and($domainTablePosition)->not->toBeFalse()
+        ->and($domainTablePosition)->toBeGreaterThan($serviceHeadingPosition);
+});
+
+it('renders each service domain group as a separate card', function () {
+    $view = file_get_contents(resource_path('views/livewire/project/service/domains.blade.php'));
+
+    expect($view)
+        ->toContain('class="flex flex-col gap-3"')
+        ->toContain('class="application-settings-section-body is-flush overflow-visible"')
+        ->not->toContain('class="border-b border-neutral-200 last:border-b-0 dark:border-white/10"');
+});
+
+it('lays out the domain settings dropdowns in responsive columns', function () {
+    $view = file_get_contents(resource_path('views/livewire/project/service/domains.blade.php'));
+    expect($view)->toContain('mt-4 grid grid-cols-1 gap-4 border-t border-neutral-200 pt-4 sm:grid-cols-2')
+        ->toContain('class="sm:col-span-2 text-[12px]');
+});
diff --git a/tests/Feature/ServiceResourceRoutingTest.php b/tests/Feature/ServiceResourceRoutingTest.php
index 9d5ac5a8a8..ede6fb6fc0 100644
--- a/tests/Feature/ServiceResourceRoutingTest.php
+++ b/tests/Feature/ServiceResourceRoutingTest.php
@@ -3,14 +3,17 @@
 use App\Jobs\DatabaseBackupJob;
 use App\Jobs\VolumeBackupJob;
 use App\Livewire\Project\Database\Import as DatabaseImport;
+use App\Livewire\Project\Service\BackupExecutions;
 use App\Livewire\Project\Service\Heading;
 use App\Livewire\Project\Service\VolumeBackup\Index as ServiceVolumeBackupIndex;
 use App\Models\Environment;
 use App\Models\InstanceSettings;
 use App\Models\LocalPersistentVolume;
 use App\Models\Project;
+use App\Models\S3Storage;
 use App\Models\ScheduledDatabaseBackup;
 use App\Models\ScheduledDatabaseBackupExecution;
+use App\Models\ScheduledVolumeBackupExecution;
 use App\Models\Server;
 use App\Models\Service;
 use App\Models\ServiceApplication;
@@ -20,6 +23,7 @@ use App\Models\Team;
 use App\Models\User;
 use Illuminate\Database\Eloquent\ModelNotFoundException;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Pagination\LengthAwarePaginator;
 use Illuminate\Support\Facades\Config;
 use Illuminate\Support\Facades\Queue;
 use Illuminate\Support\Once;
@@ -234,6 +238,7 @@ test('service database backup schedules open in the Livewire component', functio
 
 test('service database backups can be queued from the Livewire component', function () {
     Queue::fake();
+    $this->ownServiceDatabase->update(['status' => 'running:healthy']);
     $backup = ScheduledDatabaseBackup::create([
         'team_id' => $this->teamA->id,
         'frequency' => 'daily',
@@ -448,5 +453,294 @@ test('service storage backups page includes schedules from all compose databases
         ->assertSee('own-db')
         ->assertSee('analytics-db')
         ->assertSee("wire:click=\"openSchedule('{$backups->first()->uuid}')\"", false)
-        ->assertSee("wire:click=\"backupNow('database', '{$backups->first()->uuid}')\"", false);
+        ->assertSee("wire:click.stop=\"backupNow('database', '{$backups->first()->uuid}')\"", false);
+});
+
+test('service backup settings open automatically from the creation redirect', function () {
+    $backup = ScheduledDatabaseBackup::create([
+        'team_id' => $this->teamA->id,
+        'frequency' => 'daily',
+        'database_id' => $this->ownServiceDatabase->id,
+        'database_type' => $this->ownServiceDatabase->getMorphClass(),
+    ]);
+
+    Livewire::withQueryParams(['backup_uuid' => $backup->uuid])
+        ->test(ServiceVolumeBackupIndex::class, ['service' => $this->ownService])
+        ->assertSet('scheduleModalOpen', true)
+        ->assertSet('selectedDatabaseBackup.uuid', $backup->uuid)
+        ->assertSee('S3');
+});
+
+test('service backup settings reject a backup belonging to another team', function () {
+    $backup = ScheduledDatabaseBackup::create([
+        'team_id' => $this->teamB->id,
+        'frequency' => 'daily',
+        'database_id' => $this->otherServiceDatabase->id,
+        'database_type' => $this->otherServiceDatabase->getMorphClass(),
+    ]);
+
+    $this->expectException(ModelNotFoundException::class);
+
+    Livewire::withQueryParams(['backup_uuid' => $backup->uuid])
+        ->test(ServiceVolumeBackupIndex::class, ['service' => $this->ownService]);
+});
+
+test('service backups have explicit settings actions for database and storage schedules', function () {
+    $databaseBackup = ScheduledDatabaseBackup::create([
+        'team_id' => $this->teamA->id,
+        'frequency' => 'daily',
+        'database_id' => $this->ownServiceDatabase->id,
+        'database_type' => $this->ownServiceDatabase->getMorphClass(),
+    ]);
+    $volume = LocalPersistentVolume::create([
+        'name' => 'service-data',
+        'mount_path' => '/data',
+        'resource_id' => $this->ownServiceDatabase->id,
+        'resource_type' => $this->ownServiceDatabase->getMorphClass(),
+    ]);
+    $volumeBackup = $volume->scheduledBackups()->create([
+        'team_id' => $this->teamA->id,
+        'frequency' => 'daily',
+    ]);
+
+    $html = Livewire::test(ServiceVolumeBackupIndex::class, ['service' => $this->ownService])->html();
+    $dom = new DOMDocument;
+    @$dom->loadHTML($html);
+    $xpath = new DOMXPath($dom);
+    $buttons = $xpath->query('//button[contains(., "Settings")]');
+    $actions = [];
+    foreach ($buttons as $button) {
+        $actions[] = $button->getAttribute('wire:click.stop');
+    }
+
+    expect($actions)->toContain("openSchedule('{$databaseBackup->uuid}')", "openSchedule('{$volumeBackup->uuid}')");
+
+    foreach (['database' => $databaseBackup, 'storage' => $volumeBackup] as $type => $backup) {
+        $backupAction = "wire:click.stop=\"backupNow('{$type}', '{$backup->uuid}')\"";
+        $settingsAction = "wire:click.stop=\"openSchedule('{$backup->uuid}')\"";
+        expect(strpos($html, $backupAction))->toBeLessThan(strpos($html, $settingsAction));
+    }
+
+});
+
+test('members cannot open service backup settings', function () {
+    $this->userA->teams()->updateExistingPivot($this->teamA->id, ['role' => 'member']);
+    $backup = ScheduledDatabaseBackup::create([
+        'team_id' => $this->teamA->id,
+        'frequency' => 'daily',
+        'database_id' => $this->ownServiceDatabase->id,
+        'database_type' => $this->ownServiceDatabase->getMorphClass(),
+    ]);
+
+    Livewire::withQueryParams(['backup_uuid' => $backup->uuid])
+        ->test(ServiceVolumeBackupIndex::class, ['service' => $this->ownService])
+        ->assertForbidden();
+});
+
+test('closing service backup settings clears the backup query parameter', function () {
+    $backup = ScheduledDatabaseBackup::create([
+        'team_id' => $this->teamA->id,
+        'frequency' => 'daily',
+        'database_id' => $this->ownServiceDatabase->id,
+        'database_type' => $this->ownServiceDatabase->getMorphClass(),
+    ]);
+
+    $component = Livewire::withQueryParams(['backup_uuid' => $backup->uuid, 'search' => 'own-db'])
+        ->test(ServiceVolumeBackupIndex::class, ['service' => $this->ownService])
+        ->assertSet('scheduleModalOpen', true)
+        ->assertSet('backupUuid', $backup->uuid);
+
+    expect($component->effects['url']['backupUuid'])
+        ->toMatchArray(['as' => 'backup_uuid', 'use' => 'replace', 'except' => '']);
+
+    $component->dispatch('modalClosed')
+        ->assertSet('scheduleModalOpen', false)
+        ->assertSet('selectedDatabaseBackup', null)
+        ->assertSet('selectedVolumeBackup', null)
+        ->assertSet('backupUuid', '')
+        ->assertSet('search', 'own-db')
+        ->assertNoRedirect();
+});
+
+test('service execution history paginates both backup types without truncating older runs', function () {
+    $schedule = ScheduledDatabaseBackup::create([
+        'team_id' => $this->teamA->id,
+        'frequency' => 'daily',
+        'database_id' => $this->ownServiceDatabase->id,
+        'database_type' => $this->ownServiceDatabase->getMorphClass(),
+    ]);
+    $databaseExecutions = collect(range(1, 105))->map(fn ($index) => ScheduledDatabaseBackupExecution::forceCreate([
+        'scheduled_database_backup_id' => $schedule->id,
+        'status' => 'success',
+        'created_at' => now()->subMinutes($index),
+    ]));
+    $volume = LocalPersistentVolume::create([
+        'name' => 'service-data',
+        'mount_path' => '/data',
+        'resource_id' => $this->ownServiceDatabase->id,
+        'resource_type' => $this->ownServiceDatabase->getMorphClass(),
+    ]);
+    $volumeSchedule = $volume->scheduledBackups()->create(['team_id' => $this->teamA->id, 'frequency' => 'daily']);
+    $volumeExecution = ScheduledVolumeBackupExecution::create([
+        'scheduled_volume_backup_id' => $volumeSchedule->id,
+        'status' => 'success',
+    ]);
+
+    $component = Livewire::test(BackupExecutions::class, ['service' => $this->ownService])
+        ->assertViewHas('executions', function ($executions) use ($volumeExecution, $databaseExecutions) {
+            expect($executions)->toBeInstanceOf(LengthAwarePaginator::class)
+                ->and($executions->total())->toBe(106)
+                ->and($executions->count())->toBe(10)
+                ->and($executions->first()['uuid'])->toBe($volumeExecution->uuid)
+                ->and($executions->last()['uuid'])->toBe($databaseExecutions[8]->uuid);
+
+            return true;
+        })
+        ->assertSeeHtml('aria-label="Next page"');
+
+    $component->call('openExecution', $volumeExecution->uuid)
+        ->assertSet('selectedExecution.uuid', $volumeExecution->uuid)
+        ->call('closeExecutionModal');
+    $component->call('nextPage', 'executionsPage')
+        ->assertViewHas('executions', fn ($executions) => $executions->currentPage() === 2 && $executions->first()['uuid'] === $databaseExecutions[9]->uuid);
+    $component->call('setPage', 11, 'executionsPage')
+        ->assertViewHas('executions', fn ($executions) => $executions->count() === 6 && $executions->last()['uuid'] === $databaseExecutions->last()->uuid)
+        ->call('openExecution', $databaseExecutions->last()->uuid)
+        ->assertSet('executionModalOpen', true)
+        ->assertSet('selectedExecution.uuid', $databaseExecutions->last()->uuid);
+    $component->set('perPage', 25)
+        ->assertViewHas('executions', fn ($executions) => $executions->currentPage() === 1 && $executions->count() === 25);
+    $component->call('setPage', 999, 'executionsPage')
+        ->assertViewHas('executions', fn ($executions) => $executions->currentPage() === 5 && $executions->count() === 6);
+    $component->set('perPage', 1000)->assertSet('perPage', 100);
+    $component->set('perPage', 0)->assertSet('perPage', 1);
+});
+
+test('service execution pagination excludes other teams and denies opening their runs', function (string $type) {
+    $schedule = ScheduledDatabaseBackup::create([
+        'team_id' => $this->teamB->id,
+        'frequency' => 'daily',
+        'database_id' => $this->otherServiceDatabase->id,
+        'database_type' => $this->otherServiceDatabase->getMorphClass(),
+    ]);
+    $execution = ScheduledDatabaseBackupExecution::create([
+        'scheduled_database_backup_id' => $schedule->id,
+        'status' => 'success',
+    ]);
+
+    if ($type === 'storage') {
+        $volume = LocalPersistentVolume::create([
+            'name' => 'other-service-data',
+            'mount_path' => '/data',
+            'resource_id' => $this->otherServiceDatabase->id,
+            'resource_type' => $this->otherServiceDatabase->getMorphClass(),
+        ]);
+        $volumeSchedule = $volume->scheduledBackups()->create(['team_id' => $this->teamB->id, 'frequency' => 'daily']);
+        $execution = ScheduledVolumeBackupExecution::create([
+            'scheduled_volume_backup_id' => $volumeSchedule->id,
+            'status' => 'success',
+        ]);
+    }
+
+    Livewire::test(BackupExecutions::class, ['service' => $this->ownService])
+        ->assertViewHas('executions', fn ($executions) => $executions->isEmpty())
+        ->assertDontSeeHtml('aria-label="Next page"')
+        ->call('openExecution', $execution->uuid)
+        ->assertNotFound();
+})->with(['database', 'storage']);
+
+test('execution page size remains adjustable when all runs fit on one page', function () {
+    $schedule = ScheduledDatabaseBackup::create([
+        'team_id' => $this->teamA->id,
+        'frequency' => 'daily',
+        'database_id' => $this->ownServiceDatabase->id,
+        'database_type' => $this->ownServiceDatabase->getMorphClass(),
+    ]);
+    foreach (range(1, 11) as $index) {
+        $schedule->executions()->create(['status' => 'success']);
+    }
+
+    Livewire::test(BackupExecutions::class, ['service' => $this->ownService])
+        ->set('perPage', 25)
+        ->assertSeeHtml('aria-label="Items per page"')
+        ->assertDontSeeHtml('aria-label="Next page"')
+        ->set('perPage', 10)
+        ->assertSeeHtml('aria-label="Next page"');
+});
+
+test('service backup lists identify the configured S3 storage without extra columns', function () {
+    foreach (['Cloudflare R2', 'Railway S3', 'Maxio S3'] as $name) {
+        $volume = LocalPersistentVolume::create([
+            'name' => 'service-data-'.str($name)->slug(),
+            'mount_path' => '/data',
+            'resource_id' => $this->ownServiceDatabase->id,
+            'resource_type' => $this->ownServiceDatabase->getMorphClass(),
+        ]);
+        $storage = S3Storage::create(['key' => 'key', 'secret' => 'secret', 'region' => 'auto', 'endpoint' => 'https://s3.example.com', 'team_id' => $this->teamA->id, 'name' => $name, 'bucket' => 'backups']);
+        ScheduledDatabaseBackup::create([
+            'team_id' => $this->teamA->id,
+            'frequency' => 'daily',
+            'database_id' => $this->ownServiceDatabase->id,
+            'database_type' => $this->ownServiceDatabase->getMorphClass(),
+            'save_s3' => true,
+            's3_storage_id' => $storage->id,
+        ]);
+        $volume->scheduledBackups()->create([
+            'team_id' => $this->teamA->id,
+            'frequency' => 'daily',
+            'save_s3' => true,
+            's3_storage_id' => $storage->id,
+        ]);
+    }
+
+    $html = Livewire::test(ServiceVolumeBackupIndex::class, ['service' => $this->ownService])->html();
+    foreach (['Cloudflare R2', 'Railway S3', 'Maxio S3'] as $name) {
+        expect(substr_count($html, 'data-tooltip="S3 storage: '.$name.' (bucket: backups)"'))->toBe(2);
+    }
+});
+
+test('execution tooltips distinguish current database storage from the recorded storage destination', function () {
+    $original = S3Storage::create(['key' => 'key', 'secret' => 'secret', 'region' => 'auto', 'endpoint' => 'https://s3.example.com', 'team_id' => $this->teamA->id, 'name' => 'Cloudflare R2', 'bucket' => 'original']);
+    $current = S3Storage::create(['key' => 'key', 'secret' => 'secret', 'region' => 'auto', 'endpoint' => 'https://s3.example.com', 'team_id' => $this->teamA->id, 'name' => 'Railway S3', 'bucket' => 'current']);
+    $databaseSchedule = ScheduledDatabaseBackup::create([
+        'team_id' => $this->teamA->id,
+        'frequency' => 'daily',
+        'database_id' => $this->ownServiceDatabase->id,
+        'database_type' => $this->ownServiceDatabase->getMorphClass(),
+        'save_s3' => true,
+        's3_storage_id' => $current->id,
+    ]);
+    $databaseSchedule->executions()->create(['status' => 'success', 's3_uploaded' => true]);
+    $volume = LocalPersistentVolume::create([
+        'name' => 'service-data',
+        'mount_path' => '/data',
+        'resource_id' => $this->ownServiceDatabase->id,
+        'resource_type' => $this->ownServiceDatabase->getMorphClass(),
+    ]);
+    $volumeSchedule = $volume->scheduledBackups()->create([
+        'team_id' => $this->teamA->id,
+        'frequency' => 'daily',
+        'save_s3' => true,
+        's3_storage_id' => $current->id,
+    ]);
+    $volumeSchedule->executions()->create(['status' => 'success', 's3_uploaded' => true, 's3_storage_id' => $original->id]);
+
+    Livewire::test(BackupExecutions::class, ['service' => $this->ownService])
+        ->assertSeeHtml('data-tooltip="Current schedule S3 storage: Railway S3 (bucket: current)"')
+        ->assertSeeHtml('data-tooltip="S3 storage: Cloudflare R2 (bucket: original)"');
+
+    $current->update(['team_id' => $this->teamB->id]);
+    Livewire::test(ServiceVolumeBackupIndex::class, ['service' => $this->ownService])
+        ->assertDontSee('Railway S3')
+        ->assertSeeHtml('data-tooltip="S3 storage: Unavailable"');
+    Livewire::test(BackupExecutions::class, ['service' => $this->ownService])
+        ->assertDontSee('Railway S3')
+        ->assertSeeHtml('data-tooltip="Current schedule S3 storage: Unavailable"');
+
+    $databaseSchedule->update(['save_s3' => false]);
+    $original->delete();
+    Livewire::test(BackupExecutions::class, ['service' => $this->ownService])
+        ->assertSeeHtml('data-tooltip="Current schedule S3 storage: Not configured"')
+        ->assertDontSeeHtml('data-tooltip="S3 storage: Cloudflare R2 (bucket: original)"')
+        ->assertSeeHtml('data-tooltip="S3 storage: Unavailable"');
 });
diff --git a/tests/Feature/ServiceRoutingPortTest.php b/tests/Feature/ServiceRoutingPortTest.php
new file mode 100644
index 0000000000..dc4b489290
--- /dev/null
+++ b/tests/Feature/ServiceRoutingPortTest.php
@@ -0,0 +1,62 @@
+<?php
+
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\Service;
+use App\Models\ServiceApplication;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+
+uses(RefreshDatabase::class);
+
+it('does not infer a custom service port from a coincidental template name', function (int $version, string $name, ?string $type, string $declarations, ?int $expected) {
+    expect(config('database.connections.'.config('database.default').'.driver'))->toBe('sqlite');
+    expect(config('database.connections.'.config('database.default').'.database'))->toBe(':memory:');
+    InstanceSettings::forceCreate(['id' => 0]);
+    $team = Team::factory()->create();
+    $server = Server::factory()->create(['team_id' => $team->id]);
+    $server->settings->update(['generate_exact_labels' => false]);
+    $destination = StandaloneDocker::where('server_id', $server->id)->first()
+        ?? StandaloneDocker::factory()->create(['server_id' => $server->id]);
+    $project = Project::factory()->create(['team_id' => $team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+    $service = Service::factory()->create([
+        'name' => 'custom-stack',
+        'service_type' => $type,
+        'environment_id' => $environment->id,
+        'server_id' => $server->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+        'docker_compose_raw' => "services:\n  {$name}:\n    image: httpd:2.4-alpine\n{$declarations}",
+        'compose_parsing_version' => (string) $version,
+    ]);
+    ServiceApplication::create([
+        'name' => $name,
+        'service_id' => $service->id,
+        'image' => 'httpd:2.4-alpine',
+        'fqdn' => 'https://apache.example.com',
+    ]);
+    $parsed = $service->fresh()->parse();
+    $labels = collect(data_get($parsed, 'services'))->flatMap(fn ($entry) => data_get($entry, 'labels', []));
+    $ports = $labels->filter(fn ($label) => str_contains($label, '.loadbalancer.server.port='))->values()->all();
+    if ($expected === null) {
+        expect($ports)->toBeEmpty();
+        expect($labels->filter(fn ($label) => str_contains($label, 'reverse_proxy'))->implode(' '))->not->toContain('upstreams 3000');
+    } else {
+        expect($ports)->not->toBeEmpty();
+        foreach ($ports as $port) {
+            expect($port)->toEndWith('.loadbalancer.server.port='.$expected);
+        }
+    }
+})->with([4, 5])->with([
+    'UDP before HTTP' => ['web', null, "    expose: ['53/udp', '8080/tcp']\n", 8080],
+    'UDP only discovery' => ['web', null, "    expose: ['53/udp']\n", null],
+    'custom collision' => ['grafana', null, "    expose: [80]\n", 80],
+    'custom discovery' => ['grafana', null, '', null],
+    'unrelated template child' => ['web', 'grafana', '', null],
+    'real template' => ['wordpress', 'wordpress-without-database', "    environment:\n      - SERVICE_URL_WORDPRESS\n", 80],
+    'explicit magic port' => ['web', null, "    expose: [80]\n    environment:\n      - SERVICE_URL_WEB_8080\n", 8080],
+]);
diff --git a/tests/Feature/ServiceTemplatePortLookupTest.php b/tests/Feature/ServiceTemplatePortLookupTest.php
index 1e228811dd..28f8cee3c4 100644
--- a/tests/Feature/ServiceTemplatePortLookupTest.php
+++ b/tests/Feature/ServiceTemplatePortLookupTest.php
@@ -25,3 +25,9 @@ YAML,
 
     expect($app->getRequiredPort())->toBe(80);
 });
+
+it('does not infer a template port from a custom display name', function () {
+    $service = new Service(['name' => 'grafana-custom', 'service_type' => null]);
+
+    expect($service->getRequiredPort())->toBeNull();
+});
diff --git a/tests/Feature/SettingsAccessListboxTest.php b/tests/Feature/SettingsAccessListboxTest.php
index 4ec9dceb9e..c1508bf73b 100644
--- a/tests/Feature/SettingsAccessListboxTest.php
+++ b/tests/Feature/SettingsAccessListboxTest.php
@@ -29,6 +29,12 @@ test('settings advanced access section always uses listboxes', function () {
         ->not->toContain('Two-step confirmations enabled');
 });
 
+test('image storage fields use the standard settings field gap', function () {
+    $contents = file_get_contents(resource_path('views/livewire/settings/advanced.blade.php'));
+
+    expect($contents)->toContain('<div class="flex max-w-md flex-col gap-4">');
+});
+
 test('instance admin can toggle registration via listbox instantSave', function () {
     $rootTeam = Team::find(0) ?? Team::factory()->create(['id' => 0]);
     Server::factory()->create(['id' => 0, 'team_id' => $rootTeam->id]);
@@ -82,6 +88,28 @@ test('instance admin can toggle two-step confirmation via listbox instantSave',
     expect((bool) $settings->fresh()->disable_two_step_confirmation)->toBeTrue();
 });
 
+test('instance admin can configure the image CDN URL at runtime', function () {
+    $rootTeam = Team::find(0) ?? Team::factory()->create(['id' => 0]);
+    Server::factory()->create(['id' => 0, 'team_id' => $rootTeam->id]);
+    $settings = InstanceSettings::forceCreate(['id' => 0]);
+    Once::flush();
+
+    $user = User::factory()->create();
+    $rootTeam->members()->attach($user->id, ['role' => 'admin']);
+
+    $this->actingAs($user);
+    session(['currentTeam' => ['id' => $rootTeam->id]]);
+
+    Livewire::test(Advanced::class)
+        ->assertSee('Image CDN URL')
+        ->set('image_cdn_url', 'https://images.example.com/media/')
+        ->call('submit')
+        ->assertHasNoErrors()
+        ->assertDispatched('success');
+
+    expect($settings->fresh()->image_cdn_url)->toBe('https://images.example.com/media');
+});
+
 test('open API allowlist warning is hidden when API access is disabled', function () {
     $rootTeam = Team::find(0) ?? Team::factory()->create(['id' => 0]);
     Server::factory()->create(['id' => 0, 'team_id' => $rootTeam->id]);
diff --git a/tests/Feature/SettingsSectionHighlightTest.php b/tests/Feature/SettingsSectionHighlightTest.php
index a062c4c133..438f20192e 100644
--- a/tests/Feature/SettingsSectionHighlightTest.php
+++ b/tests/Feature/SettingsSectionHighlightTest.php
@@ -45,6 +45,18 @@ test('configuration sidebar subitems trigger section highlight on scroll', funct
         ->toContain('stableFrames');
 });
 
+test('application configuration subitems scroll without navigating the active page', function () {
+    $sidebar = file_get_contents(resource_path('views/components/application/configuration-sidebar.blade.php'));
+
+    expect($sidebar)
+        ->toContain("@if (\$menuItem['active'])")
+        ->toContain('<button type="button" class="menu-subitem"')
+        ->toContain("window.scrollToSettingsSection?.('{{ \$section['id'] }}')")
+        ->toContain('@else')
+        ->toContain("href=\"{{ route(\$menuItem['route'], \$applicationRouteParameters) }}#{{ \$section['id'] }}\"")
+        ->not->toContain("if (document.getElementById('{{ \$section['id'] }}'))");
+});
+
 test('postgresql general navigation lists each in-page settings section', function () {
     $sidebar = file_get_contents(resource_path('views/components/database/configuration-sidebar.blade.php'));
     $general = file_get_contents(resource_path('views/livewire/project/database/postgresql/general.blade.php'));
diff --git a/tests/Feature/SharedVariableDevViewTest.php b/tests/Feature/SharedVariableDevViewTest.php
index 34767cf06d..9b434ef994 100644
--- a/tests/Feature/SharedVariableDevViewTest.php
+++ b/tests/Feature/SharedVariableDevViewTest.php
@@ -168,3 +168,38 @@ test('server shared variable dev view updates existing variable', function () {
     expect($var->value)->toBe('new_value')
         ->and($var->comment)->toBe('updated comment');
 });
+
+test('server shared variables display built-ins as read-only rows', function () {
+    $server = Server::factory()->create(['team_id' => $this->team->id]);
+
+    Livewire::test(App\Livewire\SharedVariables\Server\Show::class, ['server_uuid' => $server->uuid])
+        ->assertSee('COOLIFY_SERVER_UUID')
+        ->assertSee('COOLIFY_SERVER_NAME')
+        ->assertSee('Built-in · Read-only')
+        ->assertDontSee('Add a variable to make it available to resources in this scope.')
+        ->assertDontSee('data-env-settings-trigger', false)
+        ->assertSet('variables', '')
+        ->call('switch')
+        ->assertSee('COOLIFY_SERVER_UUID')
+        ->assertSee('COOLIFY_SERVER_NAME')
+        ->assertSet('variables', '')
+        ->set('variables', "COOLIFY_SERVER_UUID=changed\nCOOLIFY_SERVER_NAME=changed\nCUSTOM=value")
+        ->call('submit');
+
+    expect($server->environment_variables()->pluck('value', 'key')->all())
+        ->toMatchArray(['COOLIFY_SERVER_UUID' => $server->uuid, 'COOLIFY_SERVER_NAME' => $server->name, 'CUSTOM' => 'value']);
+});
+
+test('server built-ins are visible to team members but not other teams', function () {
+    $server = Server::factory()->create(['team_id' => $this->team->id]);
+    $this->user->teams()->updateExistingPivot($this->team->id, ['role' => 'member']);
+
+    Livewire::test(App\Livewire\SharedVariables\Server\Show::class, ['server_uuid' => $server->uuid])
+        ->assertSee('COOLIFY_SERVER_UUID')
+        ->assertDontSee('Add variable');
+
+    $otherServer = Server::factory()->create(['team_id' => Team::factory()->create()->id]);
+    Livewire::test(App\Livewire\SharedVariables\Server\Show::class, ['server_uuid' => $otherServer->uuid])
+        ->assertRedirect(route('dashboard'))
+        ->assertDontSee($otherServer->uuid);
+});
diff --git a/tests/Feature/SidebarNavigationMarkupTest.php b/tests/Feature/SidebarNavigationMarkupTest.php
index 4587f1f254..c385ab72dc 100644
--- a/tests/Feature/SidebarNavigationMarkupTest.php
+++ b/tests/Feature/SidebarNavigationMarkupTest.php
@@ -27,7 +27,10 @@ it('initializes persisted sidebar state before enabling layout transitions', fun
     $layout = file_get_contents(resource_path('views/layouts/app.blade.php'));
 
     expect($layout)
-        ->toContain("collapsed: localStorage.getItem('sidebarCollapsed') === 'true'")
+        ->toContain("userCollapsed: localStorage.getItem('sidebarCollapsed') === 'true'")
+        ->toContain('return this.userCollapsed || (this.autoCollapse && this.hasSecondBar);')
+        ->toContain('this.userCollapsed = this.collapsed;')
+        ->toContain("localStorage.setItem('sidebarCollapsed', this.userCollapsed);")
         ->toContain('sidebarReady: false')
         ->toContain(":class=\"[collapsed ? 'lg:w-16' : 'lg:w-56', sidebarReady ? 'transition-[width] duration-200' : '']\"")
         ->toContain(":class=\"[collapsed ? 'lg:ml-16' : 'lg:ml-56', sidebarReady ? 'transition-[margin] duration-200' : '']\"");
diff --git a/tests/Feature/Subscription/CreateCheckoutSessionTest.php b/tests/Feature/Subscription/CreateCheckoutSessionTest.php
new file mode 100644
index 0000000000..6cb4e712b4
--- /dev/null
+++ b/tests/Feature/Subscription/CreateCheckoutSessionTest.php
@@ -0,0 +1,338 @@
+<?php
+
+use App\Actions\Stripe\CreateCheckoutSession;
+use App\Exceptions\CheckoutUnavailableException;
+use App\Models\Subscription;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Cache;
+use Stripe\Exception\ApiConnectionException;
+use Stripe\Service\BillingPortal\SessionService as BillingPortalSessionService;
+use Stripe\Service\Checkout\SessionService;
+use Stripe\Service\CustomerService;
+use Stripe\Service\SubscriptionService;
+use Stripe\Stripe;
+use Stripe\StripeClient;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    config()->set('cache.default', 'array');
+
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+
+    $this->stripe = Mockery::mock(StripeClient::class);
+    $this->checkoutSessions = Mockery::mock(SessionService::class);
+    $this->customers = Mockery::mock(CustomerService::class);
+    $this->stripeSubscriptions = Mockery::mock(SubscriptionService::class);
+    $this->stripe->checkout = (object) ['sessions' => $this->checkoutSessions];
+    $this->stripe->customers = $this->customers;
+    $this->stripe->subscriptions = $this->stripeSubscriptions;
+});
+
+function stripeCheckoutCollection(array $data, ?array $allPages = null): object
+{
+    $pages = $allPages ?? $data;
+
+    return new class($data, $pages)
+    {
+        public function __construct(
+            public array $data,
+            private array $allPages,
+        ) {}
+
+        public function autoPagingIterator(): iterable
+        {
+            yield from $this->allPages;
+        }
+    };
+}
+
+test('two near-simultaneous checkout requests reuse one open session', function () {
+    Subscription::create(['team_id' => $this->team->id, 'stripe_customer_id' => 'cus_existing']);
+
+    $openSession = (object) ['id' => 'cs_open', 'url' => 'https://checkout.stripe.test/cs_open', 'status' => 'open', 'mode' => 'subscription', 'subscription' => null];
+
+    $this->stripeSubscriptions->shouldReceive('all')->twice()->andReturn(stripeCheckoutCollection([]));
+    $this->checkoutSessions->shouldReceive('all')->twice()->andReturn(stripeCheckoutCollection([]), stripeCheckoutCollection([$openSession]));
+    $this->checkoutSessions->shouldReceive('create')->once()->andReturn($openSession);
+    $this->checkoutSessions->shouldReceive('allLineItems')->with('cs_open')->once()->andReturn(stripeCheckoutCollection([(object) ['price' => (object) ['id' => 'price_monthly']]]));
+
+    $action = new CreateCheckoutSession($this->stripe);
+    $first = $action->execute($this->team, $this->user, 'price_monthly');
+    $second = $action->execute($this->team, $this->user, 'price_monthly');
+
+    expect($first->id)->toBe('cs_open')->and($second->id)->toBe('cs_open');
+});
+
+test('checkout session expiration includes a buffer above Stripe\'s 30-minute minimum', function () {
+    $this->freezeTime();
+    Subscription::create(['team_id' => $this->team->id, 'stripe_customer_id' => 'cus_existing']);
+
+    $this->stripeSubscriptions->shouldReceive('all')->once()->andReturn(stripeCheckoutCollection([]));
+    $this->checkoutSessions->shouldReceive('all')->once()->andReturn(stripeCheckoutCollection([]));
+    $this->checkoutSessions->shouldReceive('create')->once()
+        ->withArgs(function (array $payload): bool {
+            expect($payload['expires_at'])->toBeGreaterThanOrEqual(now()->addMinutes(35)->timestamp)
+                ->and($payload['expires_at'])->toBeLessThanOrEqual(now()->addHours(24)->timestamp);
+
+            return $payload['customer'] === 'cus_existing';
+        })
+        ->andReturn((object) ['id' => 'cs_new', 'url' => 'https://checkout.stripe.test/cs_new']);
+
+    (new CreateCheckoutSession($this->stripe))->execute($this->team, $this->user, 'price_monthly');
+});
+
+test('separate checkout attempts let the SDK manage idempotency', function () {
+    Subscription::create(['team_id' => $this->team->id, 'stripe_customer_id' => 'cus_existing']);
+    $session = (object) ['id' => 'cs_retry', 'url' => 'https://checkout.stripe.test/cs_retry'];
+    $payloads = [];
+    $originalRetries = Stripe::getMaxNetworkRetries();
+
+    $this->stripeSubscriptions->shouldReceive('all')->twice()->andReturn(stripeCheckoutCollection([]));
+    $this->checkoutSessions->shouldReceive('all')->twice()->andReturn(stripeCheckoutCollection([]));
+    $this->checkoutSessions->shouldReceive('create')->twice()
+        ->withArgs(function (array $payload, array $options = []) use (&$payloads): bool {
+            expect($options)->not->toHaveKey('idempotency_key');
+            expect(Stripe::getMaxNetworkRetries())->toBe(2);
+            $payloads[] = $payload;
+
+            return $payload['customer'] === 'cus_existing';
+        })->andReturn($session);
+
+    $action = new CreateCheckoutSession($this->stripe);
+    $action->execute($this->team, $this->user, 'price_monthly');
+    $this->travel(5)->seconds();
+    $action->execute($this->team, $this->user, 'price_monthly');
+
+    expect($payloads)->toHaveCount(2)
+        ->and($payloads[1]['expires_at'])->toBeGreaterThan($payloads[0]['expires_at'])
+        ->and(Stripe::getMaxNetworkRetries())->toBe($originalRetries);
+});
+
+test('an existing active Stripe subscription blocks checkout', function () {
+    Subscription::create(['team_id' => $this->team->id, 'stripe_customer_id' => 'cus_existing', 'stripe_subscription_id' => 'sub_active']);
+    $billingPortalSessions = Mockery::mock(BillingPortalSessionService::class);
+    $this->stripe->billingPortal = (object) ['sessions' => $billingPortalSessions];
+    $this->stripeSubscriptions->shouldReceive('all')->once()->andReturn(stripeCheckoutCollection([(object) ['id' => 'sub_active', 'status' => 'active']]));
+    $billingPortalSessions->shouldNotReceive('create');
+    $this->checkoutSessions->shouldNotReceive('create');
+
+    expect(fn () => (new CreateCheckoutSession($this->stripe))->execute($this->team, $this->user, 'price_monthly'))
+        ->toThrow(CheckoutUnavailableException::class, 'active subscription');
+});
+
+test('blocking Stripe subscriptions explain the payment state instead of calling every status active', function (string $status, string $expected) {
+    Subscription::create(['team_id' => $this->team->id, 'stripe_customer_id' => 'cus_existing']);
+    $this->stripeSubscriptions->shouldReceive('all')->once()->andReturn(stripeCheckoutCollection([(object) ['id' => 'sub_blocked', 'status' => $status]]));
+    $this->checkoutSessions->shouldNotReceive('create');
+
+    try {
+        (new CreateCheckoutSession($this->stripe))->execute($this->team, $this->user, 'price_monthly');
+        $this->fail('Expected checkout to be blocked.');
+    } catch (CheckoutUnavailableException $exception) {
+        expect($exception->getMessage())
+            ->toBe($expected)
+            ->not->toContain('active subscription');
+    }
+})->with([
+    'incomplete' => ['incomplete', "This team's subscription payment is incomplete. Complete the payment in the billing portal."],
+    'past_due' => ['past_due', "This team's subscription payment is past due. Update the payment method or settle the outstanding invoice in the billing portal."],
+    'unpaid' => ['unpaid', "This team's subscription is unpaid. Settle the outstanding invoice in the billing portal."],
+    'paused' => ['paused', "This team's subscription is paused. Resume it in the billing portal."],
+]);
+
+test('recoverable blocked subscriptions include a billing portal link', function (string $status) {
+    Subscription::create(['team_id' => $this->team->id, 'stripe_customer_id' => 'cus_existing']);
+    $billingPortalSessions = Mockery::mock(BillingPortalSessionService::class);
+    $this->stripe->billingPortal = (object) ['sessions' => $billingPortalSessions];
+    $this->stripeSubscriptions->shouldReceive('all')->once()->andReturn(stripeCheckoutCollection([(object) ['id' => 'sub_blocked', 'status' => $status]]));
+    $billingPortalSessions->shouldReceive('create')->once()
+        ->withArgs(fn (array $payload): bool => $payload['customer'] === 'cus_existing' && $payload['return_url'] === route('subscription.show'))
+        ->andReturn((object) ['url' => 'https://billing.stripe.test/session']);
+    $this->checkoutSessions->shouldNotReceive('create');
+
+    try {
+        (new CreateCheckoutSession($this->stripe))->execute($this->team, $this->user, 'price_monthly');
+        $this->fail('Expected checkout to be blocked.');
+    } catch (CheckoutUnavailableException $exception) {
+        expect($exception->billingPortalUrl)
+            ->toBe('https://billing.stripe.test/session')
+            ->and($exception->getMessage())->not->toContain('active subscription');
+    }
+})->with(['incomplete', 'past_due', 'unpaid', 'paused']);
+
+test('a past due subscription still blocks checkout when the billing portal cannot be opened', function () {
+    Subscription::create(['team_id' => $this->team->id, 'stripe_customer_id' => 'cus_existing']);
+    $billingPortalSessions = Mockery::mock(BillingPortalSessionService::class);
+    $this->stripe->billingPortal = (object) ['sessions' => $billingPortalSessions];
+    $this->stripeSubscriptions->shouldReceive('all')->once()->andReturn(stripeCheckoutCollection([(object) ['id' => 'sub_past_due', 'status' => 'past_due']]));
+    $billingPortalSessions->shouldReceive('create')->once()->andThrow(new ApiConnectionException('Connection failed'));
+    $this->checkoutSessions->shouldNotReceive('create');
+
+    try {
+        (new CreateCheckoutSession($this->stripe))->execute($this->team, $this->user, 'price_monthly');
+        $this->fail('Expected checkout to be blocked.');
+    } catch (CheckoutUnavailableException $exception) {
+        expect($exception->getMessage())->toContain('past due')
+            ->and($exception->billingPortalUrl)->toBeNull();
+    }
+});
+
+test('a blocking Stripe subscription beyond the first page still blocks checkout', function () {
+    Subscription::create(['team_id' => $this->team->id, 'stripe_customer_id' => 'cus_existing']);
+
+    $firstPage = collect(range(1, 10))
+        ->map(fn (int $i): object => (object) ['id' => "sub_canceled_{$i}", 'status' => 'canceled'])
+        ->all();
+    $laterPageActive = (object) ['id' => 'sub_active_later', 'status' => 'active'];
+
+    $this->stripeSubscriptions->shouldReceive('all')->once()->andReturn(
+        stripeCheckoutCollection($firstPage, [...$firstPage, $laterPageActive])
+    );
+    $this->checkoutSessions->shouldNotReceive('create');
+
+    expect(fn () => (new CreateCheckoutSession($this->stripe))->execute($this->team, $this->user, 'price_monthly'))
+        ->toThrow(CheckoutUnavailableException::class, 'active subscription');
+});
+
+test('checkout session lookup asks Stripe for open sessions only', function () {
+    Subscription::create(['team_id' => $this->team->id, 'stripe_customer_id' => 'cus_existing']);
+    $openSession = (object) ['id' => 'cs_open', 'url' => 'https://checkout.stripe.test/cs_open', 'status' => 'open', 'mode' => 'subscription', 'subscription' => null];
+
+    $this->stripeSubscriptions->shouldReceive('all')->once()->andReturn(stripeCheckoutCollection([]));
+    $this->checkoutSessions->shouldReceive('all')->once()
+        ->with(['customer' => 'cus_existing', 'limit' => 10, 'status' => 'open'])
+        ->andReturn(stripeCheckoutCollection([$openSession]));
+    $this->checkoutSessions->shouldReceive('allLineItems')->with('cs_open')->once()->andReturn(stripeCheckoutCollection([(object) ['price' => (object) ['id' => 'price_monthly']]]));
+    $this->checkoutSessions->shouldNotReceive('create');
+
+    $session = (new CreateCheckoutSession($this->stripe))->execute($this->team, $this->user, 'price_monthly');
+
+    expect($session->id)->toBe('cs_open');
+});
+
+test('an expired checkout session permits a new checkout', function () {
+    Subscription::create(['team_id' => $this->team->id, 'stripe_customer_id' => 'cus_existing']);
+    $expired = (object) ['id' => 'cs_expired', 'status' => 'expired', 'mode' => 'subscription', 'subscription' => null];
+
+    $this->stripeSubscriptions->shouldReceive('all')->once()->andReturn(stripeCheckoutCollection([]));
+    $this->checkoutSessions->shouldReceive('all')->once()->andReturn(stripeCheckoutCollection([$expired]));
+    $this->checkoutSessions->shouldReceive('create')->once()
+        ->withArgs(fn (array $payload, array $options = []): bool => $payload['customer'] === 'cus_existing' && ! isset($options['idempotency_key']))
+        ->andReturn((object) ['id' => 'cs_new', 'url' => 'https://checkout.stripe.test/cs_new']);
+
+    $session = (new CreateCheckoutSession($this->stripe))->execute($this->team, $this->user, 'price_monthly');
+    expect($session->id)->toBe('cs_new');
+});
+
+test('checkout creates and persists one Stripe customer for later attempts', function () {
+    $this->customers->shouldReceive('create')->once()
+        ->withArgs(fn (array $payload, array $options): bool => $payload['metadata']['team_id'] === $this->team->id && $options['idempotency_key'] === 'coolify-team-'.$this->team->id.'-customer')
+        ->andReturn((object) ['id' => 'cus_new']);
+    $this->stripeSubscriptions->shouldReceive('all')->once()->andReturn(stripeCheckoutCollection([]));
+    $this->checkoutSessions->shouldReceive('all')->once()->andReturn(stripeCheckoutCollection([]));
+    $this->checkoutSessions->shouldReceive('create')->once()
+        ->withArgs(function (array $payload): bool {
+            expect($payload['automatic_tax']['enabled'])->toBeTrue()
+                ->and($payload['billing_address_collection'])->toBe('required')
+                ->and($payload['customer_update'])->toMatchArray([
+                    'name' => 'auto',
+                    'address' => 'auto',
+                ]);
+
+            return $payload['customer'] === 'cus_new';
+        })
+        ->andReturn((object) ['id' => 'cs_new', 'url' => 'https://checkout.stripe.test/cs_new']);
+
+    (new CreateCheckoutSession($this->stripe))->execute($this->team, $this->user, 'price_monthly');
+    expect($this->team->fresh()->subscription->stripe_customer_id)->toBe('cus_new');
+});
+
+test('a monthly subscription can move to yearly after Stripe confirms the old subscription ended', function () {
+    config()->set('subscription.stripe_price_id_dynamic_monthly', 'price_monthly');
+    config()->set('subscription.stripe_price_id_dynamic_yearly', 'price_yearly');
+
+    Subscription::create([
+        'team_id' => $this->team->id,
+        'stripe_customer_id' => 'cus_existing',
+        'stripe_subscription_id' => 'sub_monthly_ended',
+        'stripe_plan_id' => 'price_monthly',
+        'stripe_invoice_paid' => false,
+    ]);
+
+    $this->customers->shouldNotReceive('create');
+    $this->stripeSubscriptions->shouldReceive('all')->once()->andReturn(stripeCheckoutCollection([
+        (object) ['id' => 'sub_monthly_ended', 'status' => 'canceled'],
+    ]));
+    $this->checkoutSessions->shouldReceive('all')->once()->andReturn(stripeCheckoutCollection([]));
+    $this->checkoutSessions->shouldReceive('create')->once()
+        ->withArgs(fn (array $payload): bool => $payload['customer'] === 'cus_existing' && $payload['line_items'][0]['price'] === 'price_yearly')
+        ->andReturn((object) ['id' => 'cs_yearly', 'url' => 'https://checkout.stripe.test/cs_yearly']);
+
+    $session = (new CreateCheckoutSession($this->stripe))->execute($this->team, $this->user, 'price_yearly');
+
+    expect($session->id)->toBe('cs_yearly')
+        ->and($this->team->fresh()->subscription->stripe_customer_id)->toBe('cus_existing');
+});
+
+test('the checkout lock blocks a concurrent request before it calls Stripe', function () {
+    $lock = Cache::lock(CreateCheckoutSession::lockKey($this->team->id), 30);
+    expect($lock->get())->toBeTrue();
+
+    $this->customers->shouldNotReceive('create');
+    $this->stripeSubscriptions->shouldNotReceive('all');
+    $this->checkoutSessions->shouldNotReceive('create');
+
+    try {
+        expect(fn () => (new CreateCheckoutSession($this->stripe))->execute($this->team, $this->user, 'price_monthly'))
+            ->toThrow(CheckoutUnavailableException::class, 'already being created');
+    } finally {
+        $lock->release();
+    }
+});
+
+test('a Stripe connection failure releases the lock without creating another session', function () {
+    Subscription::create(['team_id' => $this->team->id, 'stripe_customer_id' => 'cus_existing']);
+    $originalRetries = Stripe::getMaxNetworkRetries();
+    $this->stripeSubscriptions->shouldReceive('all')->once()->andReturn(stripeCheckoutCollection([]));
+    $this->checkoutSessions->shouldReceive('all')->once()->andReturn(stripeCheckoutCollection([]));
+    $this->checkoutSessions->shouldReceive('create')->once()->andThrow(new ApiConnectionException('Connection failed'));
+
+    expect(fn () => (new CreateCheckoutSession($this->stripe))->execute($this->team, $this->user, 'price_monthly'))
+        ->toThrow(ApiConnectionException::class);
+    expect(Stripe::getMaxNetworkRetries())->toBe($originalRetries);
+    $lock = Cache::lock(CreateCheckoutSession::lockKey($this->team->id), 30);
+    try {
+        expect($lock->get())->toBeTrue();
+    } finally {
+        $lock->release();
+    }
+});
+
+test('changing checkout price expires the old session before creating the selected plan', function () {
+    Subscription::create(['team_id' => $this->team->id, 'stripe_customer_id' => 'cus_existing']);
+    $this->stripeSubscriptions->shouldReceive('all')->once()->andReturn(stripeCheckoutCollection([]));
+    $this->checkoutSessions->shouldReceive('all')->once()->andReturn(stripeCheckoutCollection([(object) ['id' => 'cs_monthly', 'mode' => 'subscription', 'status' => 'open']]));
+    $this->checkoutSessions->shouldReceive('allLineItems')->with('cs_monthly')->once()->andReturn(stripeCheckoutCollection([(object) ['price' => (object) ['id' => 'price_monthly']]]));
+    $this->checkoutSessions->shouldReceive('expire')->with('cs_monthly')->once()->globally()->ordered()->andReturn((object) ['status' => 'expired']);
+    $this->checkoutSessions->shouldReceive('create')->once()->globally()->ordered()
+        ->withArgs(fn (array $payload): bool => $payload['line_items'][0]['price'] === 'price_yearly')
+        ->andReturn((object) ['id' => 'cs_yearly']);
+    $session = (new CreateCheckoutSession($this->stripe))->execute($this->team, $this->user, 'price_yearly');
+    expect($session->id)->toBe('cs_yearly');
+});
+
+test('failed session expiration never creates a second checkout', function () {
+    Subscription::create(['team_id' => $this->team->id, 'stripe_customer_id' => 'cus_existing']);
+    $this->stripeSubscriptions->shouldReceive('all')->once()->andReturn(stripeCheckoutCollection([]));
+    $this->checkoutSessions->shouldReceive('all')->once()->andReturn(stripeCheckoutCollection([(object) ['id' => 'cs_monthly', 'mode' => 'subscription', 'status' => 'open']]));
+    $this->checkoutSessions->shouldReceive('allLineItems')->once()->andReturn(stripeCheckoutCollection([(object) ['price' => (object) ['id' => 'price_monthly']]]));
+    $this->checkoutSessions->shouldReceive('expire')->once()->andThrow(new ApiConnectionException('Cannot confirm expiration'));
+    $this->checkoutSessions->shouldNotReceive('create');
+    expect(fn () => (new CreateCheckoutSession($this->stripe))->execute($this->team, $this->user, 'price_yearly'))
+        ->toThrow(ApiConnectionException::class);
+});
diff --git a/tests/Feature/Subscription/StripeProcessJobTest.php b/tests/Feature/Subscription/StripeProcessJobTest.php
index 302edf9e2e..f681ca4a5f 100644
--- a/tests/Feature/Subscription/StripeProcessJobTest.php
+++ b/tests/Feature/Subscription/StripeProcessJobTest.php
@@ -55,9 +55,13 @@ describe('customer.subscription.created does not fall through to updated', funct
         expect($subscription->stripe_invoice_paid)->toBeFalsy();
     });
 
-    test('created event updates existing subscription instead of duplicating', function () {
+    test('created event cannot overwrite a different recorded subscription', function () {
         Queue::fake();
 
+        $rootTeam = Team::factory()->create(['id' => 0]);
+        $rootTeam->discordNotificationSettings()->update(['discord_enabled' => true]);
+        Notification::fake();
+
         Subscription::create([
             'team_id' => $this->team->id,
             'stripe_subscription_id' => 'sub_old',
@@ -84,8 +88,46 @@ describe('customer.subscription.created does not fall through to updated', funct
 
         expect(Subscription::where('team_id', $this->team->id)->count())->toBe(1);
         $subscription = Subscription::where('team_id', $this->team->id)->first();
-        expect($subscription->stripe_subscription_id)->toBe('sub_new_123');
-        expect($subscription->stripe_customer_id)->toBe('cus_new_123');
+        expect($subscription->stripe_subscription_id)->toBe('sub_old');
+        expect($subscription->stripe_customer_id)->toBe('cus_old');
+        expect($subscription->stripe_invoice_paid)->toBeTruthy();
+
+        Notification::assertSentTo($rootTeam, GeneralNotification::class, function (GeneralNotification $notification) {
+            return str_contains($notification->message, 'StripeProcessJob error:')
+                && str_contains($notification->message, 'cus_old')
+                && str_contains($notification->message, 'cus_new_123');
+        });
+    });
+
+    test('created event rejects a pending record with a different stripe customer id', function () {
+        Queue::fake();
+
+        $rootTeam = Team::factory()->create(['id' => 0]);
+        $rootTeam->discordNotificationSettings()->update(['discord_enabled' => true]);
+        Notification::fake();
+
+        Subscription::create([
+            'team_id' => $this->team->id,
+            'stripe_customer_id' => 'cus_pending',
+            'stripe_invoice_paid' => false,
+        ]);
+
+        (new StripeProcessJob(['type' => 'customer.subscription.created', 'data' => ['object' => [
+            'id' => 'sub_other',
+            'customer' => 'cus_other',
+            'metadata' => ['team_id' => $this->team->id, 'user_id' => $this->user->id],
+        ]]]))->handle();
+
+        $subscription = $this->team->subscription()->first();
+        expect($subscription->stripe_subscription_id)->toBeNull()
+            ->and($subscription->stripe_customer_id)->toBe('cus_pending')
+            ->and($subscription->stripe_invoice_paid)->toBeFalsy();
+
+        Notification::assertSentTo($rootTeam, GeneralNotification::class, function (GeneralNotification $notification) {
+            return str_contains($notification->message, 'StripeProcessJob error:')
+                && str_contains($notification->message, 'cus_pending')
+                && str_contains($notification->message, 'cus_other');
+        });
     });
 });
 
@@ -338,3 +380,32 @@ describe('missing subscription Stripe webhooks are ignored', function () {
         ]],
     ]);
 });
+
+test('late repeated subscription created events preserve confirmed payment', function () {
+    Queue::fake();
+    $completed = ['type' => 'checkout.session.completed', 'data' => ['object' => [
+        'client_reference_id' => $this->user->id.':'.$this->team->id,
+        'subscription' => 'sub_paid', 'customer' => 'cus_paid',
+    ]]];
+    (new StripeProcessJob($completed))->handle();
+    $created = ['type' => 'customer.subscription.created', 'data' => ['object' => [
+        'id' => 'sub_paid', 'customer' => 'cus_paid',
+        'metadata' => ['team_id' => $this->team->id, 'user_id' => $this->user->id],
+    ]]];
+    foreach (range(1, 2) as $attempt) {
+        (new StripeProcessJob($created))->handle();
+        expect($this->team->subscription()->first()->stripe_invoice_paid)->toBeTruthy();
+    }
+    expect($this->team->subscription()->count())->toBe(1);
+});
+
+test('created event fills a pending customer record without granting access', function () {
+    Queue::fake();
+    Subscription::create(['team_id' => $this->team->id, 'stripe_customer_id' => 'cus_pending', 'stripe_invoice_paid' => false]);
+    (new StripeProcessJob(['type' => 'customer.subscription.created', 'data' => ['object' => [
+        'id' => 'sub_pending', 'customer' => 'cus_pending',
+        'metadata' => ['team_id' => $this->team->id, 'user_id' => $this->user->id],
+    ]]]))->handle();
+    expect($this->team->subscription()->first()->stripe_subscription_id)->toBe('sub_pending')
+        ->and($this->team->subscription()->first()->stripe_invoice_paid)->toBeFalsy();
+});
diff --git a/tests/Feature/Subscription/SubscriptionPricingPageTest.php b/tests/Feature/Subscription/SubscriptionPricingPageTest.php
index 98e0c9ad4b..f411d6425e 100644
--- a/tests/Feature/Subscription/SubscriptionPricingPageTest.php
+++ b/tests/Feature/Subscription/SubscriptionPricingPageTest.php
@@ -1,5 +1,8 @@
 <?php
 
+use App\Actions\Stripe\CreateCheckoutSession;
+use App\Exceptions\CheckoutUnavailableException;
+use App\Jobs\ServerLimitCheckJob;
 use App\Livewire\Subscription\Index;
 use App\Livewire\Subscription\PricingPlans;
 use App\Models\InstanceSettings;
@@ -7,12 +10,19 @@ use App\Models\Subscription;
 use App\Models\Team;
 use App\Models\User;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Exceptions;
+use Illuminate\Support\Facades\Queue;
 use Illuminate\Support\Once;
 use Livewire\Livewire;
+use Stripe\Exception\ApiConnectionException;
+use Stripe\Service\CustomerService;
+use Stripe\Service\SubscriptionService;
+use Stripe\StripeClient;
 
 uses(RefreshDatabase::class);
 
 beforeEach(function () {
+    config()->set('app.maintenance.store', 'array');
     config()->set('constants.coolify.self_hosted', false);
     config()->set('subscription.provider', 'stripe');
     config()->set('subscription.stripe_api_key', 'sk_test_fake');
@@ -133,3 +143,120 @@ test('subscription plan page does not render a single-item plan tab strip', func
         ->and($html)->not->toContain(route('subscription.show'))
         ->and($html)->not->toContain(route('subscription.index'));
 });
+
+test('Stripe API failures show an error without redirecting or retrying checkout', function () {
+    config()->set('subscription.stripe_price_id_dynamic_monthly', 'price_monthly');
+    $this->mock(CreateCheckoutSession::class)
+        ->shouldReceive('execute')->once()
+        ->andThrow(new ApiConnectionException('Connection failed'));
+
+    Livewire::test(PricingPlans::class)
+        ->call('subscribeStripe', 'dynamic-monthly')
+        ->assertDispatched('error', 'Unable to confirm checkout with Stripe. Please try again shortly.')
+        ->assertNoRedirect();
+});
+
+test('expected checkout unavailable errors keep their user-facing messages', function (string $message) {
+    config()->set('subscription.stripe_price_id_dynamic_monthly', 'price_monthly');
+    Exceptions::fake();
+    $this->mock(CreateCheckoutSession::class)
+        ->shouldReceive('execute')->once()
+        ->andThrow(new CheckoutUnavailableException($message));
+
+    Livewire::test(PricingPlans::class)
+        ->call('subscribeStripe', 'dynamic-monthly')
+        ->assertDispatched('error', $message)
+        ->assertNoRedirect();
+
+    Exceptions::assertNothingReported();
+})->with([
+    'lock' => 'A subscription checkout is already being created for this team.',
+    'active' => 'Team already has an active subscription.',
+    'past_due' => "This team's subscription payment is past due. Update the payment method or settle the outstanding invoice in the billing portal.",
+    'incomplete' => "This team's subscription payment is incomplete. Complete the payment in the billing portal.",
+    'unpaid' => "This team's subscription is unpaid. Settle the outstanding invoice in the billing portal.",
+]);
+
+test('pricing plans links recoverable checkout blocks to the billing portal', function () {
+    config()->set('subscription.stripe_price_id_dynamic_monthly', 'price_monthly');
+    $message = "This team's subscription payment is past due. Update the payment method or settle the outstanding invoice in the billing portal.";
+    $this->mock(CreateCheckoutSession::class)
+        ->shouldReceive('execute')->once()
+        ->andThrow(new CheckoutUnavailableException($message, 'https://billing.stripe.test/session'));
+
+    Livewire::test(PricingPlans::class)
+        ->call('subscribeStripe', 'dynamic-monthly')
+        ->assertDispatched(
+            'error',
+            $message.' <a href="https://billing.stripe.test/session" target="_blank" rel="noopener noreferrer" class="underline">Open billing portal</a>'
+        )
+        ->assertNoRedirect();
+});
+
+test('unexpected checkout RuntimeExceptions are reported without exposing internal messages', function () {
+    config()->set('subscription.stripe_price_id_dynamic_monthly', 'price_monthly');
+    Exceptions::fake();
+    $this->mock(CreateCheckoutSession::class)
+        ->shouldReceive('execute')->once()
+        ->andThrow(new RuntimeException('SQLSTATE[HY000]: General error: 1 table subscriptions has no column named foo'));
+
+    Livewire::test(PricingPlans::class)
+        ->call('subscribeStripe', 'dynamic-monthly')
+        ->assertDispatched('error', 'Unable to start checkout. Please try again shortly.')
+        ->assertNoRedirect();
+
+    Exceptions::assertReported(RuntimeException::class);
+});
+
+test('subscription status check restores an active subscription after a missed webhook', function (int $quantity, int $expectedLimit, string $lookupKey) {
+    Queue::fake();
+    $this->team->update(['custom_server_limit' => 7]);
+    $subscription = Subscription::create(['team_id' => $this->team->id, 'stripe_customer_id' => 'cus_recover', 'stripe_invoice_paid' => false]);
+    $stripe = Mockery::mock(StripeClient::class);
+    $stripe->customers = Mockery::mock(CustomerService::class);
+    $stripe->subscriptions = Mockery::mock(SubscriptionService::class);
+    $stripe->customers->shouldReceive('retrieve')->with('cus_recover')->once()->andReturn((object) ['id' => 'cus_recover']);
+    $stripe->subscriptions->shouldReceive('all')->with(['customer' => 'cus_recover'])->once()->andReturn((object) ['data' => [(object) [
+        'id' => 'sub_recovered', 'status' => 'active', 'metadata' => (object) ['team_id' => (string) $this->team->id],
+        'cancel_at_period_end' => true, 'items' => (object) ['data' => [(object) ['quantity' => $quantity, 'price' => (object) ['id' => 'price_yearly', 'lookup_key' => $lookupKey]]]],
+    ]]]);
+    app()->instance(StripeClient::class, $stripe);
+
+    Livewire::test(Index::class)->call('getStripeStatus')->assertRedirect(route('subscription.show'));
+
+    expect((bool) $subscription->fresh()->stripe_invoice_paid)->toBeTrue()
+        ->and($subscription->fresh()->stripe_subscription_id)->toBe('sub_recovered')
+        ->and($subscription->fresh()->stripe_plan_id)->toBe('price_yearly')
+        ->and((bool) $subscription->fresh()->stripe_cancel_at_period_end)->toBeTrue()
+        ->and((bool) $subscription->fresh()->stripe_past_due)->toBeFalse()
+        ->and($this->team->fresh()->custom_server_limit)->toBe($expectedLimit);
+    if (str_contains($lookupKey, 'dynamic')) {
+        Queue::assertPushed(ServerLimitCheckJob::class);
+    } else {
+        Queue::assertNotPushed(ServerLimitCheckJob::class);
+    }
+})->with([[5, 5, 'dynamic_yearly'], [1, 2, 'dynamic_yearly'], [101, 100, 'dynamic_yearly'], [5, 7, 'legacy']]);
+
+test('subscription status check does not activate non-active or other-team subscriptions', function (string $status, bool $otherTeam) {
+    $subscription = Subscription::create(['team_id' => $this->team->id, 'stripe_customer_id' => 'cus_recover', 'stripe_invoice_paid' => false]);
+    $stripe = Mockery::mock(StripeClient::class);
+    $stripe->customers = Mockery::mock(CustomerService::class);
+    $stripe->subscriptions = Mockery::mock(SubscriptionService::class);
+    $stripe->customers->shouldReceive('retrieve')->once()->andReturn((object) ['id' => 'cus_recover']);
+    $stripe->subscriptions->shouldReceive('all')->once()->andReturn((object) ['data' => [(object) [
+        'id' => 'sub_other', 'status' => $status, 'metadata' => (object) ['team_id' => (string) ($otherTeam ? $this->team->id + 100 : $this->team->id)],
+    ]]]);
+    app()->instance(StripeClient::class, $stripe);
+
+    Livewire::test(Index::class)->call('getStripeStatus')->assertNoRedirect();
+    expect((bool) $subscription->fresh()->stripe_invoice_paid)->toBeFalse();
+    if ($otherTeam) {
+        expect($subscription->fresh()->stripe_subscription_id)->toBeNull();
+    }
+})->with([['incomplete', false], ['unpaid', false], ['canceled', false], ['active', true]]);
+
+test('team members cannot synchronize billing status', function () {
+    $this->team->members()->updateExistingPivot($this->user->id, ['role' => 'member']);
+    $this->user->unsetRelation('teams');
+    Livewire::test(Index::class)->call('getStripeStatus')->assertForbidden();
+});
diff --git a/tests/Feature/TeamSeederTest.php b/tests/Feature/TeamSeederTest.php
new file mode 100644
index 0000000000..96cf3a19e3
--- /dev/null
+++ b/tests/Feature/TeamSeederTest.php
@@ -0,0 +1,27 @@
+<?php
+
+use App\Models\InstanceSettings;
+use App\Models\Team;
+use App\Models\User;
+use Database\Seeders\TeamSeeder;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+
+uses(RefreshDatabase::class);
+
+it('assigns seeded memberships without assuming normal user or personal team IDs', function () {
+    InstanceSettings::create(['id' => 0]);
+    $unrelatedUser = User::factory()->create();
+    User::factory()->create(['id' => 0, 'email' => 'test@example.com']);
+    $rootTeamMember = User::factory()->create(['id' => 10, 'email' => 'test2@example.com']);
+    $otherUser = User::factory()->create(['id' => 11, 'email' => 'test3@example.com']);
+    $personalTeam = $rootTeamMember->teams()->firstOrFail();
+
+    $this->seed(TeamSeeder::class);
+
+    expect(Team::findOrFail(0)->description)->toBe('The root team')
+        ->and($rootTeamMember->teams()->whereKey(0)->exists())->toBeTrue()
+        ->and($otherUser->teams()->whereKey($personalTeam->id)->firstOrFail()->pivot->role)->toBe('admin')
+        ->and($otherUser->teams()->whereKey(0)->exists())->toBeFalse()
+        ->and($unrelatedUser->teams()->count())->toBe(1)
+        ->and($otherUser->teams()->whereKey($unrelatedUser->teams()->firstOrFail()->id)->exists())->toBeFalse();
+});
diff --git a/tests/Feature/TerminalPageHeaderTest.php b/tests/Feature/TerminalPageHeaderTest.php
index 0a7890bf3e..c4b86b5d92 100644
--- a/tests/Feature/TerminalPageHeaderTest.php
+++ b/tests/Feature/TerminalPageHeaderTest.php
@@ -90,7 +90,7 @@ it('uses the same padded themed canvas for the active terminal session', functio
     expect($view)
         ->toContain('data-terminal-session-canvas')
         ->toContain('p-3 sm:p-6')
-        ->toContain('terminal-session-panel mt-8')
+        ->toContain('terminal-session-panel flex min-h-0 flex-1 flex-col overflow-hidden p-3 sm:p-6')
         ->and($styles)
         ->toContain('.terminal-session-panel')
         ->toContain('border-radius: 0.75rem;')
@@ -145,7 +145,7 @@ it('offers the console theme selector only while a session owns the canvas', fun
         ->and($selector)
         ->toContain('terminal-theme-trigger flex h-8 items-center gap-2 rounded-md px-2.5 text-xs font-medium')
         ->and($view)
-        ->toContain('terminal-session-toolbar absolute top-3 right-3 left-3')
+        ->toContain('terminal-session-toolbar flex items-center gap-3 text-white select-none')
         ->not->toContain('terminal-theme-trigger');
 });
 
@@ -177,7 +177,7 @@ it('keeps the theme selector in the floating session toolbar', function () {
     $view = file_get_contents(resource_path('views/livewire/terminal/index.blade.php'));
 
     expect($view)
-        ->toContain('terminal-session-toolbar absolute top-3 right-3 left-3')
+        ->toContain('terminal-session-toolbar flex items-center gap-3 text-white select-none')
         ->toContain('<x-terminal.theme-selector')
         ->not->toContain('class="absolute top-3 right-3 z-20"');
 });
@@ -256,7 +256,7 @@ it('defaults to a system console theme that follows the page color mode', functi
         ->and($appCss)
         ->toContain('[data-console-theme="system"]')
         ->toContain('html:not(.dark) .application-console-shell[data-console-theme="system"]')
-        ->toContain('--console-theme-border: #d4d4d8')
+        ->toContain('--console-theme-border: oklch(87.11% 0.0055 286.29)')
         ->toContain('background: transparent')
         ->toContain('html.dark .application-console-shell[data-console-theme="system"]');
 });
diff --git a/tests/Feature/ToastPositionTest.php b/tests/Feature/ToastPositionTest.php
index 6bcfc898ea..d8b7e58790 100644
--- a/tests/Feature/ToastPositionTest.php
+++ b/tests/Feature/ToastPositionTest.php
@@ -1,5 +1,7 @@
 <?php
 
+use Symfony\Component\Process\Process;
+
 test('toast messages default to the bottom right while supporting position overrides', function () {
     $toast = file_get_contents(resource_path('views/components/toast.blade.php'));
 
@@ -24,3 +26,50 @@ test('toast copy button shows temporary success feedback', function () {
         ->toContain('x-show="toast.copied"')
         ->toContain("'bg-emerald-100 text-emerald-700 dark:bg-emerald-500/10 dark:text-emerald-400': toast.copied");
 });
+
+test('subscription success uses a persistent standard toast instead of a banner', function () {
+    $view = file_get_contents(resource_path('views/livewire/layout-popups.blade.php'));
+    if ($view === false) {
+        throw new RuntimeException('Could not read layout popups view.');
+    }
+
+    if (preg_match("/@if \\(request\\(\\)->query->get\\('success'\\)\\)(.*?)@endif/s", $view, $match) !== 1 || ! isset($match[1])) {
+        throw new RuntimeException('Could not locate the subscription success block.');
+    }
+
+    expect($match[1])->toContain("window.toast('Welcome onboard!'")
+        ->toContain('persistent: true')
+        ->not->toContain('<x-banner>');
+});
+
+test('persistent toasts survive timers hover and new notifications until dismissed', function () {
+    $process = new Process(['node', '-e', <<<'JS'
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const source = fs.readFileSync(process.argv[1], 'utf8');
+const data = source.match(/<ul x-data="([\s\S]*?)" @toast-show/)[1];
+const timers = new Map();
+let timerId = 0;
+global.setTimeout = callback => { timers.set(++timerId, callback); return timerId; };
+global.clearTimeout = id => timers.delete(id);
+const state = new Function(`return (${data})`)();
+state.$nextTick = callback => callback();
+state.addToast({ detail: { message: 'Persistent', persistent: true } });
+const persistent = state.toasts[0];
+assert.equal(timers.size, 0, 'persistent toast must not schedule dismissal');
+state.pauseToast(persistent);
+state.resumeToast(persistent);
+assert.equal(timers.size, 0, 'hover must not start a persistent toast timer');
+for (let i = 0; i < 5; i++) state.addToast({ detail: { message: 'Normal' } });
+assert(state.toasts.includes(persistent), 'new notifications must not evict persistent toast');
+assert(timers.size > 0, 'normal notifications still have timers');
+for (const callback of [...timers.values()]) callback();
+for (const callback of [...timers.values()]) callback();
+assert(state.toasts.includes(persistent), 'persistent toast survives elapsed timers');
+state.removeToast(persistent.id);
+for (const callback of [...timers.values()]) callback();
+assert(!state.toasts.includes(persistent), 'manual dismissal removes persistent toast');
+JS, resource_path('views/components/toast.blade.php')]);
+    $process->run();
+    expect($process->isSuccessful())->toBeTrue($process->getErrorOutput());
+});
diff --git a/tests/Feature/UserSeederTest.php b/tests/Feature/UserSeederTest.php
new file mode 100644
index 0000000000..ce7705453b
--- /dev/null
+++ b/tests/Feature/UserSeederTest.php
@@ -0,0 +1,48 @@
+<?php
+
+use App\Models\User;
+use Database\Seeders\UserSeeder;
+use Illuminate\Database\Schema\Blueprint;
+
+it('preserves the root ID and lets the database generate normal user IDs', function (string $connectionName, int $existingUsers) {
+    if ($connectionName === 'pgsql' && ! getenv('TEST_POSTGRES_SEEDER')) {
+        $this->markTestSkipped('Set TEST_POSTGRES_SEEDER=1 to test PostgreSQL using the configured pgsql connection.');
+    }
+
+    $originalConnectionName = config('database.default');
+    config()->set('database.default', $connectionName);
+    $connection = (new User)->getConnection();
+    $connection->beginTransaction();
+
+    try {
+        // A temporary table isolates this test from existing development users and their sequence.
+        $connection->getSchemaBuilder()->create('users', function (Blueprint $table) {
+            $table->temporary();
+            $table->id();
+            $table->string('name')->nullable();
+            $table->string('email')->unique();
+            $table->string('password');
+            $table->timestamp('email_verified_at')->nullable();
+            $table->rememberToken();
+            $table->timestamps();
+        });
+
+        User::withoutEvents(function () use ($existingUsers) {
+            User::factory()->count($existingUsers)->create();
+
+            $this->seed(UserSeeder::class);
+
+            expect(User::query()->whereIn('email', ['test@example.com', 'test2@example.com', 'test3@example.com'])->orderBy('id')->pluck('email', 'id')->all())->toBe([
+                0 => 'test@example.com',
+                $existingUsers + 1 => 'test2@example.com',
+                $existingUsers + 2 => 'test3@example.com',
+            ]);
+
+            expect(User::factory()->create()->id)->toBe($existingUsers + 3)
+                ->and(User::factory()->create()->id)->toBe($existingUsers + 4);
+        });
+    } finally {
+        $connection->rollBack();
+        config()->set('database.default', $originalConnectionName);
+    }
+})->with(['testing', 'pgsql'])->with([0, 5]);
diff --git a/tests/Feature/VolumeBackupTest.php b/tests/Feature/VolumeBackupTest.php
index b24b45dcad..36a04cecaa 100644
--- a/tests/Feature/VolumeBackupTest.php
+++ b/tests/Feature/VolumeBackupTest.php
@@ -28,6 +28,7 @@ use App\Models\StandaloneDocker;
 use App\Models\Team;
 use App\Models\User;
 use Illuminate\Database\Eloquent\Collection;
+use Illuminate\Filesystem\FilesystemAdapter;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Http\RedirectResponse;
 use Illuminate\Queue\Middleware\WithoutOverlapping;
@@ -960,6 +961,67 @@ it('enables and disables volume S3 backups from the S3 title action', function (
     expect($backup->refresh()->save_s3)->toBeFalse();
 });
 
+it('persists S3 settings the first time when a volume backup schedule does not exist yet', function () {
+    $team = Team::factory()->create();
+    signInForVolumeBackups($this, $team);
+    [$application, $volume] = createVolumeBackupApplication($team);
+    $s3Storage = S3Storage::create([
+        'name' => 'Volume backups',
+        'region' => 'us-east-1',
+        'key' => 'key',
+        'secret' => 'secret',
+        'bucket' => 'bucket',
+        'endpoint' => 'https://s3.example.com',
+        'team_id' => $team->id,
+        'is_usable' => true,
+    ]);
+
+    Livewire::test(VolumeBackups::class, [
+        'storage' => $volume,
+        'resource' => $application,
+        'section' => 's3',
+    ])
+        ->assertSet('s3StorageId', $s3Storage->id)
+        ->call('toggleS3')
+        ->assertSet('saveToS3', true)
+        ->assertDispatched('success');
+
+    $backup = ScheduledVolumeBackup::query()->sole();
+
+    expect($backup->enabled)->toBeFalse()
+        ->and($backup->save_s3)->toBeTrue()
+        ->and($backup->s3_storage_id)->toBe($s3Storage->id);
+});
+
+it('persists the selected S3 storage when a volume backup schedule does not exist yet', function () {
+    $team = Team::factory()->create();
+    signInForVolumeBackups($this, $team);
+    [$application, $volume] = createVolumeBackupApplication($team);
+    $s3Storage = S3Storage::create([
+        'name' => 'Volume backups',
+        'region' => 'us-east-1',
+        'key' => 'key',
+        'secret' => 'secret',
+        'bucket' => 'bucket',
+        'endpoint' => 'https://s3.example.com',
+        'team_id' => $team->id,
+        'is_usable' => true,
+    ]);
+
+    Livewire::test(VolumeBackups::class, [
+        'storage' => $volume,
+        'resource' => $application,
+        'section' => 's3',
+    ])
+        ->set('s3StorageId', $s3Storage->id)
+        ->assertDispatched('success');
+
+    $backup = ScheduledVolumeBackup::query()->sole();
+
+    expect($backup->enabled)->toBeFalse()
+        ->and($backup->s3_storage_id)->toBe($s3Storage->id);
+});
+
 it('shows and saves volume S3 retention while S3 backups are disabled', function () {
     $team = Team::factory()->create();
     signInForVolumeBackups($this, $team);
@@ -1004,7 +1066,7 @@ it('allows team owners to edit volume backup retention settings', function () {
     ])->assertDontSee('You do not have permission to perform this action.');
 });
 
-it('only updates S3 fields when toggling volume S3 backups', function () {
+it('does not enable S3 backups when another volume backup setting is invalid', function () {
     $team = Team::factory()->create();
     signInForVolumeBackups($this, $team);
     [$application, $volume] = createVolumeBackupApplication($team);
@@ -1031,9 +1093,54 @@ it('only updates S3 fields when toggling volume S3 backups', function () {
     ])
         ->set('frequency', 'not a valid schedule')
         ->call('toggleS3')
-        ->assertDispatched('success');
+        ->assertHasErrors('frequency')
+        ->assertNotDispatched('success');
 
-    expect($backup->refresh()->save_s3)->toBeTrue()
+    expect($backup->refresh()->save_s3)->toBeFalse()
+        ->and($backup->frequency)->toBe('daily');
+});
+
+it('does not change S3 storage when another volume backup setting is invalid', function () {
+    $team = Team::factory()->create();
+    signInForVolumeBackups($this, $team);
+    [$application, $volume] = createVolumeBackupApplication($team);
+    $firstS3Storage = S3Storage::create([
+        'name' => 'First storage',
+        'region' => 'us-east-1',
+        'key' => 'first-key',
+        'secret' => 'secret',
+        'bucket' => 'first-bucket',
+        'endpoint' => 'https://s3.example.com',
+        'team_id' => $team->id,
+        'is_usable' => true,
+    ]);
+    $secondS3Storage = S3Storage::create([
+        'name' => 'Second storage',
+        'region' => 'us-east-1',
+        'key' => 'second-key',
+        'secret' => 'secret',
+        'bucket' => 'second-bucket',
+        'endpoint' => 'https://s3.example.com',
+        'team_id' => $team->id,
+        'is_usable' => true,
+    ]);
+    $backup = $volume->scheduledBackups()->create([
+        'team_id' => $team->id,
+        'frequency' => 'daily',
+        's3_storage_id' => $firstS3Storage->id,
+    ]);
+
+    Livewire::test(VolumeBackups::class, [
+        'storage' => $volume,
+        'resource' => $application,
+        'section' => 's3',
+    ])
+        ->set('frequency', 'not a valid schedule')
+        ->set('s3StorageId', $secondS3Storage->id)
+        ->assertHasErrors('frequency')
+        ->assertNotDispatched('success');
+
+    expect($backup->refresh()->s3_storage_id)->toBe($firstS3Storage->id)
         ->and($backup->frequency)->toBe('daily');
 });
 
@@ -1796,6 +1903,152 @@ it('keeps the upload destination on the volume backup execution', function () {
         ->and($execution->s3->is($s3Storage))->toBeTrue();
 });
 
+it('streams S3-only volume backups without creating or copying a local archive', function () {
+    config(['broadcasting.default' => 'null']);
+    defined('CURLOPT_RESOLVE') || define('CURLOPT_RESOLVE', 10203);
+    Carbon::setTestNow('2026-08-15 12:00:00');
+    InstanceSettings::unguarded(fn () => InstanceSettings::create(['id' => 0]));
+    $team = Team::factory()->create();
+    [$application, $volume] = createVolumeBackupApplication($team);
+    $s3Storage = S3Storage::create([
+        'name' => 'Streaming destination',
+        'region' => 'us-east-1',
+        'key' => 'key',
+        'secret' => 'secret',
+        'bucket' => 'bucket',
+        'endpoint' => 'https://s3.amazonaws.com',
+        'team_id' => $team->id,
+        'is_usable' => true,
+    ]);
+    $backup = $volume->scheduledBackups()->create([
+        'team_id' => $team->id,
+        'frequency' => 'daily',
+        'save_s3' => true,
+        'disable_local_backup' => true,
+        's3_storage_id' => $s3Storage->id,
+    ]);
+    $sshDisk = Storage::fake('ssh-keys');
+    $disk = Mockery::mock(FilesystemAdapter::class);
+    $disk->shouldReceive('files')->once()->andReturn([]);
+    $disk->shouldReceive('delete')->zeroOrMoreTimes()->andReturnTrue();
+    Storage::shouldReceive('disk')->with('ssh-keys')->andReturn($sshDisk);
+    Storage::shouldReceive('build')->once()->andReturn($disk);
+    Process::fake([
+        '*mc pipe*' => "Added `temporary` successfully.\n128 bytes -> `temporary/bucket/archive.tar.gz`\n128",
+        '*' => '',
+    ]);
+
+    (new VolumeBackupJob($backup))->handle();
+
+    $execution = ScheduledVolumeBackupExecution::query()->sole();
+    $expectedFilename = 'volume-app-data-1786795200.tar.gz';
+    Process::assertRan(fn ($process) => str_contains($process->command, 'tar -I')
+        && str_contains($process->command, 'mc pipe')
+        && str_contains($process->command, '>/dev/null && (compressor=')
+        && str_contains($process->command, '>/dev/null) && mc stat')
+        && str_contains($process->command, 'temporary/bucket/')
+        && str_contains($process->command, $expectedFilename)
+        && substr_count($process->command, '--resolve') === 3
+        && substr_count($process->command, '>/dev/null') >= 2
+        && ! str_contains($process->command, ' > ')
+        && ! str_contains($process->command, 'mc cp'));
+    expect($execution->status)->toBe('success')
+        ->and($execution->size)->toBe(128)
+        ->and($execution->s3_uploaded)->toBeTrue()
+        ->and($execution->local_storage_deleted)->toBeTrue();
+});
+
+it('fails an unsupported S3 stream without falling back to a local archive', function () {
+    config(['broadcasting.default' => 'null']);
+    InstanceSettings::unguarded(fn () => InstanceSettings::create(['id' => 0]));
+    $team = Team::factory()->create();
+    [$application, $volume] = createVolumeBackupApplication($team);
+    $s3Storage = S3Storage::create([
+        'name' => 'Unsupported streaming destination',
+        'region' => 'us-east-1',
+        'key' => 'key',
+        'secret' => 'secret',
+        'bucket' => 'bucket',
+        'endpoint' => 'https://s3.amazonaws.com',
+        'team_id' => $team->id,
+        'is_usable' => true,
+    ]);
+    $backup = $volume->scheduledBackups()->create([
+        'team_id' => $team->id,
+        'frequency' => 'daily',
+        'save_s3' => true,
+        'disable_local_backup' => true,
+        's3_storage_id' => $s3Storage->id,
+    ]);
+    $sshDisk = Storage::fake('ssh-keys');
+    $disk = Mockery::mock(FilesystemAdapter::class);
+    $disk->shouldReceive('files')->zeroOrMoreTimes()->andReturn([]);
+    $disk->shouldReceive('delete')->once()->andReturnTrue();
+    Storage::shouldReceive('disk')->with('ssh-keys')->andReturn($sshDisk);
+    Storage::shouldReceive('build')->zeroOrMoreTimes()->andReturn($disk);
+    Process::fake([
+        '*mc pipe*' => Process::result(errorOutput: 'streaming upload is unsupported', exitCode: 1),
+        '*' => '',
+    ]);
+
+    expect(fn () => (new VolumeBackupJob($backup))->handle())
+        ->toThrow(RuntimeException::class, 'Enable local backups to use the local archive upload method.');
+
+    $execution = ScheduledVolumeBackupExecution::query()->sole();
+    expect($execution->status)->toBe('failed')
+        ->and($execution->message)->toContain('The S3 destination may not support streaming uploads.')
+        ->and($execution->message)->toContain('Enable local backups to use the local archive upload method.')
+        ->and($execution->filename)->toBeNull()
+        ->and($execution->local_storage_deleted)->toBeTrue();
+    Process::assertRan(fn ($process) => str_contains($process->command, 'mc pipe')
+        && ! str_contains($process->command, 'mc cp')
+        && ! str_contains($process->command, ' > '));
+    Process::assertNotRan(fn ($process) => str_contains($process->command, 'mkdir -p')
+        || (str_contains($process->command, 'rm -f') && str_contains($process->command, '.tar.gz')));
+});
+
+it('keeps local-first archive creation and mc copy when retaining a local volume backup', function () {
+    config(['broadcasting.default' => 'null']);
+    InstanceSettings::unguarded(fn () => InstanceSettings::create(['id' => 0]));
+    $team = Team::factory()->create();
+    [$application, $volume] = createVolumeBackupApplication($team);
+    $s3Storage = S3Storage::create([
+        'name' => 'Copied destination',
+        'region' => 'us-east-1',
+        'key' => 'key',
+        'secret' => 'secret',
+        'bucket' => 'bucket',
+        'endpoint' => 'https://s3.amazonaws.com',
+        'team_id' => $team->id,
+        'is_usable' => true,
+    ]);
+    $backup = $volume->scheduledBackups()->create([
+        'team_id' => $team->id,
+        'frequency' => 'daily',
+        'save_s3' => true,
+        'disable_local_backup' => false,
+        's3_storage_id' => $s3Storage->id,
+    ]);
+    $sshDisk = Storage::fake('ssh-keys');
+    $disk = Mockery::mock(FilesystemAdapter::class);
+    $disk->shouldReceive('files')->once()->andReturn([]);
+    $disk->shouldReceive('delete')->zeroOrMoreTimes()->andReturnTrue();
+    Storage::shouldReceive('disk')->with('ssh-keys')->andReturn($sshDisk);
+    Storage::shouldReceive('build')->once()->andReturn($disk);
+    Process::fake([
+        '*du -b*' => '128',
+        '*' => '',
+    ]);
+
+    (new VolumeBackupJob($backup))->handle();
+
+    Process::assertRan(fn ($process) => str_contains($process->command, 'tar -I')
+        && str_contains($process->command, '>')
+        && ! str_contains($process->command, 'mc pipe'));
+    Process::assertRan(fn ($process) => str_contains($process->command, 'mc cp')
+        && ! str_contains($process->command, 'mc pipe'));
+});
+
 it('removes local volume backups older than the configured retention days', function () {
     config(['broadcasting.default' => 'null']);
     InstanceSettings::unguarded(fn () => InstanceSettings::create(['id' => 0]));
diff --git a/tests/Unit/BodyScrollbarLayoutTest.php b/tests/Unit/BodyScrollbarLayoutTest.php
index 6fbded50ef..5a8f961f5c 100644
--- a/tests/Unit/BodyScrollbarLayoutTest.php
+++ b/tests/Unit/BodyScrollbarLayoutTest.php
@@ -1,7 +1,19 @@
 <?php
 
-test('app layouts always reserve space for the vertical scrollbar', function (string $layout) {
+test('app layouts let the root element own vertical scrolling', function (string $layout) {
     $contents = file_get_contents(dirname(__DIR__, 2).'/'.$layout);
 
-    expect($contents)->toMatch('/<body(?:\s+[^>]*)?class="[^"]*overflow-y-scroll[^"]*"[^>]*>/');
+    expect($contents)->not->toMatch('/<body(?:\s+[^>]*)?class="[^"]*overflow-y-scroll[^"]*"[^>]*>/');
 })->with(['resources/views/layouts/base.blade.php']);
+
+test('scroll locking is left to Alpine scrollbar compensation', function () {
+    $styles = file_get_contents(dirname(__DIR__, 2).'/resources/css/app.css');
+
+    expect($styles)->not->toMatch('/html\s*\{[^}]*scrollbar-gutter:\s*stable;/s');
+});
+
+test('desktop navbar uses the document width', function () {
+    $layout = file_get_contents(dirname(__DIR__, 2).'/resources/views/layouts/app.blade.php');
+
+    expect($layout)->not->toMatch('/class="[^"]*hidden lg:flex fixed top-0 inset-x-0[^"]*w-screen[^"]*"/');
+});
diff --git a/tests/Unit/HetznerDeletionFailedNotificationTest.php b/tests/Unit/HetznerDeletionFailedNotificationTest.php
index 22d5e80db3..bcd3f294ee 100644
--- a/tests/Unit/HetznerDeletionFailedNotificationTest.php
+++ b/tests/Unit/HetznerDeletionFailedNotificationTest.php
@@ -19,7 +19,7 @@ it('can be instantiated with correct properties', function () {
         ->and($notification->errorMessage)->toBe('Hetzner API error: Server not found');
 });
 
-it('uses hetzner_deletion_failed event for channels', function () {
+it('uses the always-send hetzner_deletion_failure event for channels', function () {
     $notification = new HetznerDeletionFailed(
         hetznerServerId: 12345,
         teamId: 1,
@@ -28,7 +28,7 @@ it('uses hetzner_deletion_failed event for channels', function () {
 
     $mockNotifiable = Mockery::mock();
     $mockNotifiable->shouldReceive('getEnabledChannels')
-        ->with('hetzner_deletion_failed')
+        ->with('hetzner_deletion_failure')
         ->once()
         ->andReturn([]);
 
diff --git a/tests/Unit/Notifications/Channels/WebhookChannelTest.php b/tests/Unit/Notifications/Channels/WebhookChannelTest.php
new file mode 100644
index 0000000000..783159e69e
--- /dev/null
+++ b/tests/Unit/Notifications/Channels/WebhookChannelTest.php
@@ -0,0 +1,113 @@
+<?php
+
+use App\Jobs\SendWebhookJob;
+use App\Models\InstanceSettings;
+use App\Models\PersonalAccessToken;
+use App\Models\Server;
+use App\Models\Team;
+use App\Notifications\ApiTokenExpiringNotification;
+use App\Notifications\Channels\WebhookChannel;
+use App\Notifications\Internal\GeneralNotification;
+use App\Notifications\Server\ForceDisabled;
+use App\Notifications\Server\ForceEnabled;
+use App\Notifications\SslExpirationNotification;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Notifications\Notification;
+use Illuminate\Support\Facades\Queue;
+use Tests\TestCase;
+
+uses(TestCase::class, RefreshDatabase::class);
+
+beforeEach(function () {
+    // base_url() resolves the instance settings singleton, which lives at the id = 0 sentinel.
+    InstanceSettings::unguarded(fn () => InstanceSettings::query()->updateOrCreate(['id' => 0], [
+        'fqdn' => 'https://coolify.example.com',
+    ]));
+    Queue::fake();
+
+    $this->team = Team::create([
+        'name' => 'Webhook Channel Team',
+        'personal_team' => false,
+        'show_boarding' => false,
+    ]);
+    // Assign through the model so the `encrypted` cast on webhook_url is applied.
+    $settings = $this->team->webhookNotificationSettings;
+    $settings->webhook_enabled = true;
+    $settings->webhook_url = 'https://webhook.example.com/coolify';
+    $settings->save();
+    $this->team->refresh();
+});
+
+/**
+ * Send a notification through the webhook channel and return the dispatched payload.
+ *
+ * @return array<string, mixed>
+ */
+function deliverOverWebhook(Team $team, Notification $notification): array
+{
+    expect($notification->via($team))->toContain(WebhookChannel::class);
+
+    (new WebhookChannel)->send($team, $notification);
+
+    $payload = null;
+    Queue::assertPushed(SendWebhookJob::class, function (SendWebhookJob $job) use (&$payload) {
+        $payload = $job->payload;
+
+        return true;
+    });
+
+    expect($payload)->toBeArray()
+        ->and($payload['success'])->toBeBool()
+        ->and($payload['message'])->toBeString()->not->toBeEmpty();
+
+    return $payload;
+}
+
+it('delivers ssl certificate renewal notifications over the webhook channel', function () {
+    $payload = deliverOverWebhook(
+        $this->team,
+        new SslExpirationNotification([(object) ['name' => 'my-application']])
+    );
+
+    expect($payload['event'])->toBe('ssl_certificate_renewal')
+        ->and($payload['resources'])->toBe(['my-application']);
+});
+
+it('delivers api token expiring notifications over the webhook channel', function () {
+    $token = new PersonalAccessToken([
+        'name' => 'ci-token',
+        'expires_at' => now()->addDay(),
+    ]);
+
+    $payload = deliverOverWebhook($this->team, new ApiTokenExpiringNotification($token));
+
+    expect($payload['event'])->toBe('api_token_expiring')
+        ->and($payload['token_name'])->toBe('ci-token');
+});
+
+it('delivers server force enabled notifications over the webhook channel', function () {
+    $server = Server::factory()->create(['team_id' => $this->team->id]);
+
+    $payload = deliverOverWebhook($this->team, new ForceEnabled($server));
+
+    expect($payload['event'])->toBe('server_force_enabled')
+        ->and($payload['success'])->toBeTrue()
+        ->and($payload['server_uuid'])->toBe($server->uuid);
+});
+
+it('delivers server force disabled notifications over the webhook channel', function () {
+    $server = Server::factory()->create(['team_id' => $this->team->id]);
+
+    $payload = deliverOverWebhook($this->team, new ForceDisabled($server));
+
+    expect($payload['event'])->toBe('server_force_disabled')
+        ->and($payload['success'])->toBeFalse()
+        ->and($payload['server_uuid'])->toBe($server->uuid);
+});
+
+it('delivers general notifications over the webhook channel', function () {
+    $payload = deliverOverWebhook($this->team, new GeneralNotification('Something happened'));
+
+    expect($payload['event'])->toBe('general')
+        ->and($payload['message'])->toBe('Something happened');
+});
diff --git a/tests/Unit/ParseCommandsByLineForSudoTest.php b/tests/Unit/ParseCommandsByLineForSudoTest.php
index b741b875f2..93c9f8b643 100644
--- a/tests/Unit/ParseCommandsByLineForSudoTest.php
+++ b/tests/Unit/ParseCommandsByLineForSudoTest.php
@@ -1,6 +1,7 @@
 <?php
 
 use App\Models\Server;
+use Symfony\Component\Process\Process;
 
 beforeEach(function () {
     // Create a mock server with non-root user
@@ -184,6 +185,50 @@ test('handles if statements by adding sudo to condition', function () {
     expect($result[0])->toBe('if sudo command -v docker');
 });
 
+test('preserves shell negation before sudo', function (string $command, string $expected) {
+    expect(parseCommandsByLineForSudo(collect([$command]), $this->server))->toBe([$expected]);
+})->with([
+    'negated condition' => ['if ! docker inspect coolify-proxy; then', 'if ! sudo docker inspect coolify-proxy; then'],
+    'indented condition' => ["\tif  !  docker inspect coolify-proxy; then", "\tif  !  sudo docker inspect coolify-proxy; then"],
+    'negated pipeline' => [
+        '    if ! docker ps -a --format "{{.Names}}" | grep -q "^coolify-proxy$"; then',
+        '    if ! sudo docker ps -a --format "{{.Names}}" | sudo grep -q "^coolify-proxy$"; then',
+    ],
+    'standalone negation' => ['! docker inspect coolify-proxy', '! sudo docker inspect coolify-proxy'],
+    'repeated negation' => ['if ! ! docker inspect coolify-proxy; then', 'if ! ! sudo docker inspect coolify-proxy; then'],
+    'literal exclamation argument' => ['echo "! docker"', 'echo "! docker"'],
+]);
+
+test('proxy removal loop exits only once the container is absent', function (string $containers, string $expected) {
+    $commands = collect([
+        'for i in {1..15}; do',
+        '    if ! docker ps -a --format "{{.Names}}" | grep -q "^coolify-proxy$"; then',
+        '        echo "Container removed successfully."',
+        '        break',
+        '    fi',
+        '    echo "Waiting for container to be removed... ($i/15)"',
+        'done',
+    ]);
+    $script = <<<'BASH'
+sudo() { "$@"; }
+docker() { printf '%s\n' "$CONTAINERS"; }
+BASH;
+    $script .= "\n".implode("\n", parseCommandsByLineForSudo($commands, $this->server));
+    $process = new Process(['bash', '-c', $script], env: ['CONTAINERS' => $containers]);
+    $process->run();
+
+    expect($process->isSuccessful())->toBeTrue()
+        ->and($process->getErrorOutput())->toBe('')
+        ->and($process->getOutput())->toBe($expected);
+})->with([
+    'removed' => ['', "Container removed successfully.\n"],
+    'other containers remain' => ['another-container', "Container removed successfully.\n"],
+    'still present' => ['coolify-proxy', implode('', array_map(
+        fn (int $attempt): string => "Waiting for container to be removed... ($attempt/15)\n",
+        range(1, 15),
+    ))],
+]);
+
 test('skips sudo for fi statements', function () {
     $commands = collect([
         'fi',
@@ -457,6 +502,7 @@ test('handles real-world proxy startup with for loop from StartProxy action', fu
 
     // Verify other control structures remain correct
     expect($result[0])->toStartWith('if sudo docker ps');
+    expect($result[6])->toBe('        if ! sudo docker ps -a --format "{{.Names}}" | sudo grep -q "^coolify-proxy$"; then');
     expect($result[8])->toBe('        fi');
     expect($result[13])->toBe('fi');
 });
diff --git a/tests/Unit/ProductionImageWorkflowTest.php b/tests/Unit/ProductionImageWorkflowTest.php
index 140a6276f2..8d64d5b12a 100644
--- a/tests/Unit/ProductionImageWorkflowTest.php
+++ b/tests/Unit/ProductionImageWorkflowTest.php
@@ -23,8 +23,8 @@ it('publishes v4 branch builds under the commit sha with a traceable internal ve
         ->toContain('ARG COOLIFY_VERSION')
         ->toContain('ENV COOLIFY_VERSION=${COOLIFY_VERSION}')
         ->and($constants)
-        ->toContain("'version' => env('COOLIFY_VERSION') ?: '4.3.17'")
-        ->and($versions['coolify']['v4']['version'])->toBe('4.3.17')
+        ->toContain("'version' => env('COOLIFY_VERSION') ?: '4.3.19'")
+        ->and($versions['coolify']['v4']['version'])->toBe('4.3.19')
         ->and($versions['coolify']['nightly']['version'])->toBe('4.4-rc.1')
         ->and($nightlyVersions)->toBe($versions);
 });
diff --git a/tests/Unit/ShadowConsistencyTest.php b/tests/Unit/ShadowConsistencyTest.php
new file mode 100644
index 0000000000..5469915006
--- /dev/null
+++ b/tests/Unit/ShadowConsistencyTest.php
@@ -0,0 +1,57 @@
+<?php
+
+function cssSource(string $file): string
+{
+    return file_get_contents(__DIR__.'/../../resources/css/'.$file);
+}
+
+function bladeSource(string $path): string
+{
+    return file_get_contents(__DIR__.'/../../resources/views/'.$path);
+}
+
+it('gives the shared popover surface the dropdown lift, not the modal lift', function () {
+    $utilities = cssSource('utilities.css');
+
+    expect($utilities)
+        ->toContain('@utility surface-popover')
+        ->toContain('var(--shadow-dropdown)');
+
+    // The surface-popover block itself must not fall back to the heavy modal shadow.
+    preg_match('/@utility surface-popover\s*\{(.*?)\}/s', $utilities, $match);
+    expect($match[1] ?? '')
+        ->toContain('var(--shadow-dropdown)')
+        ->not->toContain('var(--shadow-modal)');
+});
+
+it('renders toasts and change-pending popovers with the shared dropdown-level surface', function (string $path) {
+    $source = bladeSource($path);
+
+    expect($source)
+        ->toContain('surface-popover')
+        ->not->toContain('--shadow-modal');
+})->with([
+    'components/toast.blade.php',
+    'components/configuration-warning.blade.php',
+    'components/proxy-configuration-warning.blade.php',
+    'components/popup-small.blade.php',
+    'livewire/deployments-indicator.blade.php',
+]);
+
+it('uses the dropdown shadow on floating menus instead of the modal shadow', function (string $path) {
+    expect(bladeSource($path))
+        ->toContain('shadow-dropdown')
+        ->not->toContain('shadow-modal');
+})->with([
+    'livewire/server/show.blade.php',
+    'livewire/project/application/deployment/show.blade.php',
+]);
+
+it('gives the command palette the shared dropdown lift', function () {
+    $app = cssSource('app.css');
+
+    preg_match('/\.command-palette\s*\{(.*?)\}/s', $app, $match);
+    expect($match[1] ?? '')
+        ->toContain('var(--shadow-dropdown)')
+        ->not->toContain('var(--shadow-modal)');
+});
diff --git a/tests/v4/Browser/ApplicationConfigurationTest.php b/tests/v4/Browser/ApplicationConfigurationTest.php
index fa7fb4ffa3..f3e5b6cc8c 100644
--- a/tests/v4/Browser/ApplicationConfigurationTest.php
+++ b/tests/v4/Browser/ApplicationConfigurationTest.php
@@ -1,6 +1,10 @@
 <?php
 
+use App\Models\ApplicationPreview;
+use App\Models\InstanceSettings;
+use App\Models\LocalPersistentVolume;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Cache;
 use Visus\Cuid2\Cuid2;
 
 uses(RefreshDatabase::class);
@@ -37,6 +41,61 @@ it('shows application configuration sections and navigation', function () {
         ->screenshot(filename: 'application-configuration-overview');
 });
 
+it('keeps the PR suffix listbox visible outside the volumes table while scrolling', function () {
+    foreach (range(1, 8) as $index) {
+        LocalPersistentVolume::create([
+            'uuid' => (string) new Cuid2,
+            'name' => $this->application->uuid.'-data-'.$index,
+            'mount_path' => '/data/'.$index,
+            'resource_id' => $this->application->id,
+            'resource_type' => $this->application->getMorphClass(),
+            'is_preview_suffix_enabled' => true,
+        ]);
+    }
+
+    loginAndSkipBoarding();
+
+    $url = applicationConfigurationUrl(
+        $this->stack['project'],
+        $this->stack['environment'],
+        $this->application
+    ).'/persistent-storage';
+
+    $page = visit($url);
+    $page->assertSee('PR suffix')
+        ->assertSee('Add suffix')
+        ->assertScript(<<<'JS'
+            () => {
+                const table = document.querySelector('.data-table');
+                const trigger = document.querySelector('[id$="isPreviewSuffixEnabled-trigger"]');
+                window.__volumeTableScrollHeight = table.scrollHeight;
+                trigger.click();
+
+                return true;
+            }
+            JS)
+        ->wait(0.2)
+        ->assertScript(<<<'JS'
+            () => {
+                const table = document.querySelector('.data-table');
+                const panel = document.querySelector('[id$="isPreviewSuffixEnabled-panel"]');
+                const beforeScroll = panel.getBoundingClientRect();
+                window.scrollBy(0, 100);
+                const afterScroll = panel.getBoundingClientRect();
+
+                return panel.parentElement === document.body
+                    && table.scrollHeight === window.__volumeTableScrollHeight
+                    && window.scrollY > 0
+                    && beforeScroll.top >= 0
+                    && beforeScroll.bottom <= window.innerHeight
+                    && afterScroll.top >= 0
+                    && afterScroll.bottom <= window.innerHeight;
+            }
+            JS)
+        ->assertNoJavaScriptErrors()
+        ->screenshot(filename: 'application-persistent-storage-pr-suffix-listbox');
+});
+
 it('saves application name description and ports from the general form', function () {
     loginAndSkipBoarding();
 
@@ -153,3 +212,149 @@ it('shows danger zone for application deletion', function () {
         ->assertSee('Config App')
         ->screenshot(filename: 'application-danger-zone');
 });
+
+it('uses compact application domains with unified settings and a floating save bar', function () {
+    config()->set('app.maintenance.store', 'array');
+    InstanceSettings::find(0)->update(['is_dns_validation_enabled' => false]);
+    Cache::forget('instance_settings');
+    $this->application->update(['fqdn' => 'https://first.example.com,https://second.example.com', 'redirect' => 'both']);
+    loginAndSkipBoarding();
+    $url = applicationConfigurationUrl($this->stack['project'], $this->stack['environment'], $this->application).'/domains';
+    $page = visit($url);
+    $page->click('Accept and close')
+        ->assertSee('Check all DNS')
+        ->assertSee('Protocol redirect')
+        ->assertSee('Search indexing')
+        ->assertDontSee('Search engine indexing')
+        ->fill('[aria-label="Search services or domains"]', 'missing.example.com')
+        ->assertSee('No domains found')
+        ->fill('[aria-label="Search services or domains"]', '')
+        ->click('[aria-label="Settings for https://first.example.com"]')
+        ->assertSee('Domain settings')
+        ->assertValue('#editingDomainParts-host', 'first.example.com')
+        ->assertMissing('.is-dirty [wire\\:click="updateDomain"]')
+        ->fill('#editingDomainParts-path', '/blog')
+        ->assertVisible('.is-dirty:not(.is-saving) [wire\\:click="updateDomain"]')
+        ->click('[id^="application-domain-indexing-"][id$="-trigger"]')
+        ->click('Noindex')
+        ->assertSee('Search engine indexing updated.')
+        ->assertVisible('.is-dirty:not(.is-saving) [wire\\:click="updateDomain"]')
+        ->screenshot(filename: 'application-domain-unified-settings')
+        ->click('[wire\\:click="updateDomain"]')
+        ->assertDontSee('Domain settings')
+        ->assertSee('https://first.example.com/blog')
+        ->assertNoJavaScriptErrors()
+        ->screenshot(filename: 'application-domains-compact');
+
+    $page->click('[aria-label="Settings for https://second.example.com"]')
+        ->fill('#editingDomainParts-path', '/discard')
+        ->click('Reset')
+        ->assertDontSee('Domain settings')
+        ->click('[aria-label="Settings for https://second.example.com"]')
+        ->assertValue('#editingDomainParts-path', '')
+        ->click('[aria-label="Close"]:visible')
+        ->click('[wire\\:key="domain-row-'.md5('https://first.example.com/blog|').'"] [aria-label="Remove domain"]')
+        ->assertSee('Remove domain?')
+        ->click('button:has([x-text="step2ButtonText"]):visible')
+        ->assertDontSee('https://first.example.com/blog')
+        ->click('[aria-label="Settings for https://second.example.com"]')
+        ->assertValue('#editingDomainParts-host', 'second.example.com')
+        ->click('[aria-label="Close"]:visible')
+        ->resize(390, 844)
+        ->assertNoJavaScriptErrors()
+        ->screenshot(filename: 'application-domains-mobile');
+    expect($page->script('document.documentElement.scrollWidth <= window.innerWidth'))->toBeTrue();
+});
+
+it('edits Compose application domain redirects in the unified settings dialog', function () {
+    config()->set('app.maintenance.store', 'array');
+    InstanceSettings::find(0)->update(['is_dns_validation_enabled' => false]);
+    Cache::forget('instance_settings');
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'docker_compose_raw' => "services:\n  web.api:\n    image: nginx:alpine\n    expose:\n      - '8080'\n",
+        'docker_compose_domains' => json_encode(['web.api' => ['domain' => 'https://web.example.com', 'redirect' => 'both']]),
+    ]);
+    loginAndSkipBoarding();
+    $url = applicationConfigurationUrl($this->stack['project'], $this->stack['environment'], $this->application).'/domains';
+    $page = visit($url);
+    $page->click('Accept and close')
+        ->assertSee('web.api')
+        ->assertSee('Domain redirect')
+        ->click('[aria-label="Settings for https://web.example.com"]')
+        ->assertSee('Domain settings')
+        ->click('[id^="application-domain-direction-"][id$="-trigger"]')
+        ->click('Redirect to www')
+        ->assertDontSee('Use a different port?')
+        ->assertSee('Redirect updated for web.api.')
+        ->assertNoJavaScriptErrors()
+        ->screenshot(filename: 'application-compose-domain-settings');
+
+    expect(json_decode($this->application->fresh()->docker_compose_domains, true)['web.api']['redirect'])->toBe('www');
+    $page->click('[aria-label="Close"]:visible')
+        ->assertSee('https://www.web.example.com')
+        ->screenshot(filename: 'application-compose-domain-overview');
+});
+
+it('uses compact preview domains and opens only the selected preview settings', function (bool $isCompose) {
+    config()->set('app.maintenance.store', 'array');
+    InstanceSettings::find(0)->update(['is_dns_validation_enabled' => false]);
+    Cache::forget('instance_settings');
+    if ($isCompose) {
+        $this->application->update([
+            'build_pack' => 'dockercompose',
+            'compose_parsing_version' => '3',
+            'docker_compose_raw' => "services:\n  web.api:\n    image: nginx:alpine\n    expose:\n      - '8080'\n",
+            'docker_compose_domains' => json_encode(['web.api' => ['domain' => 'https://production.example.com']]),
+        ]);
+    }
+    foreach ([101, 102] as $number) {
+        ApplicationPreview::create([
+            'application_id' => $this->application->id,
+            'pull_request_id' => $number,
+            'pull_request_html_url' => "https://example.com/pull/{$number}",
+            'fqdn' => $isCompose ? null : "https://preview-{$number}.example.com",
+            'docker_compose_domains' => $isCompose ? json_encode(['web.api' => ['domain' => "https://preview-{$number}.example.com"]]) : null,
+        ]);
+    }
+    loginAndSkipBoarding();
+    $url = applicationConfigurationUrl($this->stack['project'], $this->stack['environment'], $this->application).'/preview-deployments';
+    $page = visit($url);
+    $page->click('Accept and close')
+        ->click('[aria-label="Settings for https://preview-101.example.com"]')
+        ->assertSee('Domain settings')
+        ->assertVisible('[aria-label="Search indexing blocked"] >> nth=0');
+    expect($page->script("[...document.querySelectorAll('[data-preview-domain-dialog]')].filter(el => el.getClientRects().length > 0).length"))->toBe(1);
+    $page->fill('#editingDomainParts-host:visible', 'renamed-preview.example.com')
+        ->assertVisible('.is-dirty:not(.is-saving) [wire\\:click="updateDomain"]')
+        ->screenshot(filename: 'preview-domain-unified-settings')
+        ->click('.is-dirty [wire\\:click="updateDomain"]')
+        ->assertDontSee('Domain settings')
+        ->assertSee('https://renamed-preview.example.com')
+        ->assertSee('https://preview-102.example.com')
+        ->assertNoJavaScriptErrors()
+        ->screenshot(filename: 'preview-domains-compact');
+    $page->click('[aria-label="Settings for https://preview-102.example.com"]')
+        ->assertSee('Domain settings')
+        ->fill('#editingDomainParts-path:visible', '/discard')
+        ->assertVisible('.is-dirty:not(.is-saving) [wire\\:click="updateDomain"]')
+        ->screenshot(filename: 'preview-domain-before-reset')
+        ->click('.is-dirty button:has-text("Reset")')
+        ->assertDontSee('Domain settings')
+        ->click('[aria-label="Settings for https://preview-102.example.com"]')
+        ->assertValue('#editingDomainParts-path:visible', '')
+        ->click('[data-preview-domain-dialog]:visible [aria-label="Close"]')
+        ->resize(390, 844)
+        ->assertNoJavaScriptErrors()
+        ->screenshot(filename: 'preview-domains-mobile');
+    expect($page->script('document.documentElement.scrollWidth <= window.innerWidth'))->toBeTrue();
+})->with(['regular application' => false, 'Compose application' => true]);
+
+it('declares the compact preview domain layout and shared save bar', function () {
+    $view = file_get_contents(resource_path('views/livewire/project/application/preview-domains.blade.php'));
+    expect($view)->toContain('service-domains-overview-grid')
+        ->toContain('service-domain-mobile-summary')
+        ->toContain('Domain routing summary')
+        ->toContain('<x-unsaved-bar action="updateDomain"')
+        ->toContain('$event.detail.previewId');
+});
diff --git a/tests/v4/Browser/LoginTest.php b/tests/v4/Browser/LoginTest.php
index 7a6d6f2b7c..df960a71b1 100644
--- a/tests/v4/Browser/LoginTest.php
+++ b/tests/v4/Browser/LoginTest.php
@@ -4,6 +4,7 @@ use App\Models\InstanceSettings;
 use App\Models\User;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Support\Facades\Hash;
+use Laravel\Fortify\Fortify;
 
 uses(RefreshDatabase::class);
 
@@ -69,6 +70,43 @@ it('fails login with invalid credentials', function () {
         ->screenshot(filename: 'login-invalid-credentials');
 });
 
+it('submits the automatic two factor challenge only once', function () {
+    config(['app.maintenance.driver' => 'file']);
+
+    $user = createRootUser();
+    $user->forceFill([
+        'two_factor_secret' => Fortify::currentEncrypter()->encrypt('JBSWY3DPEHPK3PXP'),
+        'two_factor_confirmed_at' => now(),
+    ])->save();
+
+    $page = visit('/login')
+        ->fill('email', 'test@example.com')
+        ->fill('password', 'password')
+        ->click('Login')
+        ->assertPathIs('/two-factor-challenge');
+
+    $page->script(<<<'JS'
+        window.acceptedTwoFactorSubmissions = 0;
+
+        document.querySelector('form[action="/two-factor-challenge"]').addEventListener('submit', (event) => {
+            if (!event.defaultPrevented) {
+                window.acceptedTwoFactorSubmissions++;
+            }
+
+            event.preventDefault();
+        });
+    JS);
+
+    $page->fill('code', '123456')
+        ->keys('code', 'Enter')
+        ->assertScript('window.acceptedTwoFactorSubmissions', 1)
+        ->assertDisabled('Verify and continue')
+        ->fill('code', '654321')
+        ->assertScript('window.acceptedTwoFactorSubmissions', 1)
+        ->assertNoJavaScriptErrors()
+        ->screenshot(filename: 'login-two-factor-enter-single-submission');
+});
+
 /**
  * Create the root user (id 0) with known credentials for browser login tests.
  */
diff --git a/tests/v4/Browser/ServiceConfigurationTest.php b/tests/v4/Browser/ServiceConfigurationTest.php
index d5c840ae60..6f7919664a 100644
--- a/tests/v4/Browser/ServiceConfigurationTest.php
+++ b/tests/v4/Browser/ServiceConfigurationTest.php
@@ -1,6 +1,8 @@
 <?php
 
+use App\Models\InstanceSettings;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Cache;
 use Visus\Cuid2\Cuid2;
 
 uses(RefreshDatabase::class);
@@ -189,3 +191,130 @@ it('shows service danger zone', function () {
         ->assertSee('Config Service')
         ->screenshot(filename: 'service-danger-zone');
 });
+
+it('keeps domain settings out of the overview and supports editing and removal', function () {
+    config()->set('app.maintenance.store', 'array');
+    InstanceSettings::find(0)->update(['is_dns_validation_enabled' => false]);
+    Cache::forget('instance_settings');
+    $this->serviceApplication->update([
+        'fqdn' => 'https://long-public-domain-for-the-service.example.com,https://second.example.com',
+        'domain_port_overrides' => ['https://long-public-domain-for-the-service.example.com' => 8080],
+    ]);
+    loginAndSkipBoarding();
+
+    $url = serviceConfigurationUrl($this->stack['project'], $this->stack['environment'], $this->service).'/domains';
+    $page = visit($url);
+    $page->click('Accept and close')
+        ->assertSee('Check all DNS')
+        ->assertVisible('[aria-label="Internal port 8080"]')
+        ->assertDontSee('Search engine indexing')
+        ->assertDontSee('Remove domain')
+        ->screenshot(filename: 'service-domains-overview');
+
+    expect($page->script("document.querySelector('.data-table-row.service-domains-overview-grid').getBoundingClientRect().height"))->toBeLessThanOrEqual(48);
+    expect($page->script("getComputedStyle(document.querySelector('.data-table-row.service-domains-overview-grid')).gridTemplateColumns.split(' ').length"))->toBe(7);
+
+    $page->click('[aria-label="Settings for https://long-public-domain-for-the-service.example.com"]')
+        ->assertSee('Domain settings')
+        ->assertValue('#editingDomainParts-host', 'long-public-domain-for-the-service.example.com')
+        ->assertValue('#editingDomainParts-port', '8080')
+        ->assertDontSee('Edit address and port')
+        ->assertDontSee('Save address')
+        ->assertMissing('.is-dirty [wire\\:click="updateDomain"]')
+        ->assertSee('Search engine indexing')
+        ->screenshot(filename: 'service-domain-settings');
+
+    expect($page->script(<<<'JS'
+        (() => {
+            const indexing = document.querySelector('[id^="service-domain-indexing-"][id$="-trigger"]').getBoundingClientRect();
+            const redirect = document.querySelector('[id^="service-domain-direction-"][id$="-trigger"]').getBoundingClientRect();
+            return Math.abs(indexing.top - redirect.top) < 2 && redirect.left > indexing.right;
+        })()
+    JS))->toBeTrue();
+
+    $page->fill('#editingDomainParts-port', '80')
+        ->assertVisible('.is-dirty:not(.is-saving) [wire\\:click="updateDomain"]')
+        ->screenshot(filename: 'service-domain-unsaved-changes');
+
+    $domainKey = hash('sha256', 'https://long-public-domain-for-the-service.example.com|'.$this->serviceApplication->id);
+    $page->click('#service-domain-indexing-'.$this->serviceApplication->id.'-'.$domainKey.'-trigger')
+        ->click('Noindex')
+        ->screenshot(filename: 'service-domain-indexing-saved')
+        ->assertSee('Domain settings')
+        ->assertVisible('[aria-label="Search indexing blocked"]')
+        ->assertVisible('.is-dirty:not(.is-saving) [wire\\:click="updateDomain"]')
+        ->assertNoJavaScriptErrors();
+
+    expect($this->serviceApplication->fresh()->isDomainNoindexed('https://long-public-domain-for-the-service.example.com'))->toBeTrue();
+
+    $page->click('[wire\\:click="updateDomain"]')
+        ->assertDontSee('Domain settings')
+        ->assertVisible('[aria-label="Internal port 80"] >> nth=0');
+
+    $page->click('[wire\\:key="svc-domain-'.$this->serviceApplication->id.'-'.md5('https://long-public-domain-for-the-service.example.com').'"] [aria-label="Remove domain"]')
+        ->assertSee('Remove domain?')
+        ->assertNoJavaScriptErrors()
+        ->screenshot(filename: 'service-domain-removal-confirmation')
+        ->click('button:has([x-text="step2ButtonText"]):visible')
+        ->assertDontSee('https://long-public-domain-for-the-service.example.com')
+        ->assertSee('1 domain across 1 service')
+        ->click('[aria-label="Settings for https://second.example.com"]')
+        ->assertSee('www redirect')
+        ->assertValue('#editingDomainParts-host', 'second.example.com')
+        ->click('[aria-label="Close"]:visible')
+        ->assertDontSee('Domain settings')
+        ->assertNoJavaScriptErrors();
+
+    $page->click('[aria-label="Settings for https://second.example.com"]')
+        ->fill('#editingDomainParts-path', '/discard-this')
+        ->assertVisible('.is-dirty:not(.is-saving) [wire\\:click="updateDomain"]')
+        ->click('Reset')
+        ->assertDontSee('Domain settings')
+        ->click('[aria-label="Settings for https://second.example.com"]')
+        ->assertValue('#editingDomainParts-path', '')
+        ->assertMissing('.is-dirty [wire\\:click="updateDomain"]')
+        ->click('[aria-label="Close"]:visible')
+        ->assertDontSee('Domain settings')
+        ->assertNoJavaScriptErrors();
+
+    $page->script("document.querySelectorAll('[aria-label=\"Dismiss\"]').forEach(button => button.click()); document.documentElement.classList.remove('dark');");
+    $page->screenshot(filename: 'service-domains-light');
+    $page->resize(390, 844)
+        ->assertSee('https://second.example.com')
+        ->assertVisible('[aria-label="Settings for https://second.example.com"]');
+    $page->script("document.getElementById('service-domains-section').scrollIntoView(); window.scrollBy(0, -80);");
+    $page->screenshot(filename: 'service-domains-mobile');
+
+    expect($page->script('document.documentElement.scrollWidth <= window.innerWidth'))->toBeTrue();
+});
+
+it('inherits the internal port when enabling the www redirect without a warning', function (?int $override) {
+    config()->set('app.maintenance.store', 'array');
+    InstanceSettings::find(0)->update(['is_dns_validation_enabled' => false]);
+    Cache::forget('instance_settings');
+    $this->service->update([
+        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n    environment:\n      - SERVICE_FQDN_WEB_80\n  api:\n    image: httpd:alpine\n",
+    ]);
+    $this->serviceApplication->update(['fqdn' => 'https://web.example.com', 'redirect' => 'both', 'domain_port_overrides' => $override === null ? null : ['https://web.example.com' => $override]]);
+    loginAndSkipBoarding();
+
+    $url = serviceConfigurationUrl($this->stack['project'], $this->stack['environment'], $this->service).'/domains';
+    $page = visit($url);
+    $page->click('Accept and close')
+        ->click('[aria-label="Settings for https://web.example.com"]')
+        ->click('[id^="service-domain-direction-"][id$="-trigger"]')
+        ->click('Redirect to www')
+        ->assertDontSee('Use a different port?')
+        ->assertSee('Redirect updated.')
+        ->assertNoJavaScriptErrors()
+        ->screenshot(filename: 'service-redirect-port-'.($override ?? 80));
+
+    expect($this->serviceApplication->fresh()->redirect)->toBe('www')
+        ->and($this->serviceApplication->fresh()->domain_port_overrides['https://www.web.example.com'] ?? null)->toBe($override);
+
+    $page->navigate($url)
+        ->click('[aria-label="Settings for https://web.example.com"]')
+        ->assertSee('Redirect to www')
+        ->assertNoJavaScriptErrors()
+        ->screenshot(filename: 'service-redirect-persisted-'.($override ?? 80));
+})->with([null, 8080]);
diff --git a/versions.json b/versions.json
index 0e83c0cf74..e2d8c18bc8 100644
--- a/versions.json
+++ b/versions.json
@@ -1,7 +1,7 @@
 {
     "coolify": {
         "v4": {
-            "version": "4.3.17"
+            "version": "4.3.19"
         },
         "nightly": {
             "version": "4.4-rc.1"