diff --git a/app/Actions/Database/RestartDatabase.php b/app/Actions/Database/RestartDatabase.php
index 51f4e61636..db3ce6025f 100644
--- a/app/Actions/Database/RestartDatabase.php
+++ b/app/Actions/Database/RestartDatabase.php
@@ -23,6 +23,10 @@ class RestartDatabase
         if (! $server->isFunctional()) {
             return 'Server is not functional';
         }
+        $busyError = StartDatabase::operationInProgressError($database);
+        if ($busyError !== null) {
+            return $busyError;
+        }
         $prerequisiteError = StartDatabase::prerequisiteError($database);
         if ($prerequisiteError !== null) {
             return $prerequisiteError;
diff --git a/app/Actions/Database/StartDatabase.php b/app/Actions/Database/StartDatabase.php
index 4ed70adffc..e272b7edc4 100644
--- a/app/Actions/Database/StartDatabase.php
+++ b/app/Actions/Database/StartDatabase.php
@@ -36,6 +36,10 @@ class StartDatabase
         if (! $server->isFunctional()) {
             return 'Server is not functional';
         }
+        $busyError = self::operationInProgressError($database);
+        if ($busyError !== null) {
+            return $busyError;
+        }
         $prerequisiteError = self::prerequisiteError($database);
         if ($prerequisiteError !== null) {
             return $prerequisiteError;
@@ -84,6 +88,29 @@ class StartDatabase
         return $activity;
     }
 
+    /**
+     * Refuse a second start/restart while a start, restart or import of this database is
+     * queued or running. The UI hides Start/Restart in this state; this is the server-side check.
+     * Stale start activities do not block and are marked as failed, so the UI stays consistent.
+     */
+    public static function operationInProgressError(StandaloneRedis|StandalonePostgresql|StandaloneMongodb|StandaloneMysql|StandaloneMariadb|StandaloneKeydb|StandaloneDragonfly|StandaloneClickhouse $database): ?string
+    {
+        if (blank($database->uuid)) {
+            return null;
+        }
+
+        $liveOperations = collect([
+            ResourceStartActivity::DATABASE_START_OPERATION,
+            ResourceStartActivity::DATABASE_IMPORT_OPERATION,
+        ])->flatMap(fn (string $operation) => ResourceStartActivity::failStale(
+            ResourceStartActivity::active($database->uuid, $operation)
+        ));
+
+        return $liveOperations->isNotEmpty() || ResourceStartActivity::latestRunning($database->uuid) !== null
+            ? ResourceStartActivity::DATABASE_OPERATION_IN_PROGRESS_MESSAGE
+            : null;
+    }
+
     /**
      * Check prerequisites that would make the queued start fail, so the user gets the
      * error immediately instead of a queued start that can only fail later.
diff --git a/app/Actions/Database/StartDatabaseImport.php b/app/Actions/Database/StartDatabaseImport.php
index 0359bbc2ab..aea98b0045 100644
--- a/app/Actions/Database/StartDatabaseImport.php
+++ b/app/Actions/Database/StartDatabaseImport.php
@@ -2,7 +2,6 @@
 
 namespace App\Actions\Database;
 
-use App\Enums\ProcessStatus;
 use App\Models\S3Storage;
 use App\Models\Server;
 use App\Models\ServiceDatabase;
@@ -11,6 +10,7 @@ use App\Support\DatabaseBackupFileValidator;
 use App\Support\DatabaseImport\DatabaseImportCommandBuilder;
 use App\Support\DatabaseImport\DatabaseImportException;
 use App\Support\DatabaseImport\DatabaseImportSource;
+use App\Support\ResourceStartActivity;
 use App\Support\ValidationPatterns;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Support\Facades\Cache;
@@ -68,12 +68,8 @@ class StartDatabaseImport
 
     private function startImport(Model $resource, DatabaseImportSource $source, int $teamId, Server $server, string $container, string $network): Activity
     {
-        $active = Activity::query()->where('properties->team_id', $teamId)
-            ->where('properties->type_uuid', $resource->uuid)
-            ->where('properties->operation', 'database_import')
-            ->whereIn('properties->status', [ProcessStatus::QUEUED->value, ProcessStatus::IN_PROGRESS->value])
-            ->exists();
-        if ($active) {
+        $active = ResourceStartActivity::active($resource->uuid, ResourceStartActivity::DATABASE_IMPORT_OPERATION, $teamId);
+        if (ResourceStartActivity::failStale($active)->isNotEmpty()) {
             throw new DatabaseImportException('A database import is already running.', 409);
         }
 
@@ -145,11 +141,13 @@ class StartDatabaseImport
         $commandList[] = 'rm -f '.escapeshellarg($scriptPath);
         $commandList[] = 'docker exec '.escapeshellarg($container).' sh -c '.escapeshellarg($scriptPath);
 
-        $activity = remote_process($commandList, $server, type_uuid: $resource->uuid, model: $resource, callEventOnFinish: 'DatabaseImportFinished', callEventData: $cleanup);
-        $activity->properties = $activity->properties->merge(['operation' => 'database_import', 'resource_kind' => $resource instanceof ServiceDatabase ? 'service_database' : 'standalone_database', 'operation_uuid' => $operation]);
-        $activity->save();
-
-        return $activity;
+        // The operation properties are set when the activity is created: the CoolifyTask job can
+        // load and save the activity before a later update, which would drop them again.
+        return remote_process($commandList, $server, type_uuid: $resource->uuid, model: $resource, callEventOnFinish: 'DatabaseImportFinished', callEventData: $cleanup, properties: [
+            'operation' => ResourceStartActivity::DATABASE_IMPORT_OPERATION,
+            'resource_kind' => $resource instanceof ServiceDatabase ? 'service_database' : 'standalone_database',
+            'operation_uuid' => $operation,
+        ]);
     }
 
     private function target(Model $resource): array
diff --git a/app/Actions/Proxy/GetProxyConfiguration.php b/app/Actions/Proxy/GetProxyConfiguration.php
index d910b7b0aa..6de9e03de7 100644
--- a/app/Actions/Proxy/GetProxyConfiguration.php
+++ b/app/Actions/Proxy/GetProxyConfiguration.php
@@ -44,6 +44,10 @@ class GetProxyConfiguration
             if (empty(trim($proxy_configuration ?? ''))) {
                 $proxy_configuration = $this->backfillFromDisk($server);
             }
+
+            if (! empty(trim($proxy_configuration ?? '')) && removeLegacyTraefikDashboardExposure($server)) {
+                $proxy_configuration = $server->proxy->get('last_saved_proxy_configuration');
+            }
         }
 
         // Generate default configuration as last resort
diff --git a/app/Actions/Server/ConfigureTrafficAnalytics.php b/app/Actions/Server/ConfigureTrafficAnalytics.php
index b47f03d0b6..287df678a1 100644
--- a/app/Actions/Server/ConfigureTrafficAnalytics.php
+++ b/app/Actions/Server/ConfigureTrafficAnalytics.php
@@ -8,25 +8,44 @@ use App\Jobs\RestartProxyJob;
 use App\Models\Server;
 use App\Services\ProxyPortParser;
 use Lorisleiva\Actions\Concerns\AsAction;
+use RuntimeException;
+use Throwable;
 
 class ConfigureTrafficAnalytics
 {
     use AsAction;
 
-    public function handle(Server $server, bool $enable): void
+    private const STOPPED_PROXY_STATUSES = ['exited', 'stopped', 'stopping', 'dead'];
+
+    /**
+     * Turn traffic analytics on or off. The proxy configuration is saved before the setting,
+     * so a failure leaves both unchanged.
+     *
+     * @return bool Whether a proxy restart was queued to apply the new configuration.
+     */
+    public function handle(Server $server, bool $enable): bool
     {
-        $configuration = GetProxyConfiguration::run($server);
-        ProxyPortParser::fromConfiguration($configuration);
+        if ($enable && ($reason = $server->trafficAnalyticsUnsupportedReason()) !== null) {
+            throw new RuntimeException($reason);
+        }
 
         $sentinelWasEnabled = (bool) $server->settings->is_sentinel_enabled;
 
+        // Disabling must still work after the proxy was removed, so there may be no proxy configuration to update.
+        $hasProxy = $server->hasTrafficAnalyticsProxy();
+        if ($hasProxy) {
+            $this->saveProxyConfiguration($server, $enable);
+        }
+
         $server->settings->is_traffic_analytics_enabled = $enable;
         $server->settings->save();
         $server->refresh();
 
-        $configuration = applyTrafficAnalyticsToProxyConfiguration($server, $configuration);
-        SaveProxyConfiguration::run($server, $configuration);
-        RestartProxyJob::dispatch($server);
+        // A proxy the user stopped stays stopped; its next start applies the saved configuration.
+        $restartProxy = $hasProxy && ! $this->proxyIsStopped($server);
+        if ($restartProxy) {
+            RestartProxyJob::dispatch($server);
+        }
 
         // Recreate Sentinel so it picks up (enabling) or drops (disabling) the traffic env + proxy-log mount.
         // Enabling analytics needs Sentinel running; when disabling, only restart if Sentinel was already
@@ -34,5 +53,35 @@ class ConfigureTrafficAnalytics
         if ($enable || $sentinelWasEnabled) {
             StartSentinel::run($server, restart: true);
         }
+
+        return $restartProxy;
+    }
+
+    private function saveProxyConfiguration(Server $server, bool $enable): void
+    {
+        $previousEnabled = (bool) $server->settings->is_traffic_analytics_enabled;
+        $previousProxy = $server->proxy->all();
+
+        try {
+            $configuration = GetProxyConfiguration::run($server);
+            ProxyPortParser::fromConfiguration($configuration);
+
+            // The configuration is built from the in-memory setting; it is persisted only after the save succeeds.
+            $server->settings->is_traffic_analytics_enabled = $enable;
+            $configuration = applyTrafficAnalyticsToProxyConfiguration($server, $configuration);
+            SaveProxyConfiguration::run($server, $configuration);
+        } catch (Throwable $exception) {
+            $server->settings->is_traffic_analytics_enabled = $previousEnabled;
+            $server->proxy = $previousProxy;
+            $server->save();
+
+            throw $exception;
+        }
+    }
+
+    private function proxyIsStopped(Server $server): bool
+    {
+        return (bool) $server->proxy->get('force_stop')
+            || in_array($server->proxy->get('status'), self::STOPPED_PROXY_STATUSES, true);
     }
 }
diff --git a/app/Actions/Server/StartSentinel.php b/app/Actions/Server/StartSentinel.php
index 3857d8c4d3..914ec7e099 100644
--- a/app/Actions/Server/StartSentinel.php
+++ b/app/Actions/Server/StartSentinel.php
@@ -17,9 +17,18 @@ class StartSentinel
             : rtrim($server->proxyPath(), '/');
     }
 
+    /**
+     * Sentinel reads the proxy access log only when analytics is on and a Traefik or Caddy proxy writes it.
+     * After a switch to a proxy without analytics support, Sentinel must not keep the old log mount.
+     */
+    public static function collectsTraffic(Server $server): bool
+    {
+        return $server->isTrafficAnalyticsEnabled() && $server->hasTrafficAnalyticsProxy();
+    }
+
     public static function sentinelTrafficEnvironment(Server $server): array
     {
-        if (! $server->isTrafficAnalyticsEnabled()) {
+        if (! self::collectsTraffic($server)) {
             return [];
         }
 
@@ -44,6 +53,26 @@ class StartSentinel
         return $env;
     }
 
+    /**
+     * Sentinel opens the access log once at startup and never retries, so the file must exist
+     * before the container starts. `touch` keeps an existing log intact.
+     *
+     * @return array<int, string>
+     */
+    public static function trafficLogPreparationCommands(Server $server): array
+    {
+        if (! $server->isTrafficAnalyticsEnabled() || ! $server->supportsTrafficAnalytics()) {
+            return [];
+        }
+
+        $directory = self::trafficLogDirectory($server);
+
+        return [
+            'mkdir -p '.escapeshellarg($directory),
+            'touch '.escapeshellarg($directory.'/access.log'),
+        ];
+    }
+
     public function handle(Server $server, bool $restart = false, ?string $latestVersion = null, ?string $customImage = null)
     {
         if ($server->isSwarm() || $server->isBuildServer()) {
@@ -84,7 +113,7 @@ class StartSentinel
         $dockerEnvironments = implode(' ', array_map(fn ($key, $value) => '-e '.escapeshellarg("$key=$value"), array_keys($environments), $environments));
         $dockerLabels = implode(' ', array_map(fn ($key, $value) => "$key=$value", array_keys($labels), $labels));
         $trafficLogDirectory = self::trafficLogDirectory($server);
-        $trafficMount = $server->isTrafficAnalyticsEnabled()
+        $trafficMount = self::collectsTraffic($server)
             ? '-v '.escapeshellarg("{$trafficLogDirectory}:{$trafficLogDirectory}:ro").' '
             : '';
         $network = $server->isLocalhost() ? ' --network coolify' : '';
@@ -96,6 +125,7 @@ class StartSentinel
         instant_remote_process([
             'docker rm -f coolify-sentinel || true',
             "mkdir -p $mountDir",
+            ...self::trafficLogPreparationCommands($server),
             $dockerCommand,
             "chown -R 9999:root $mountDir",
             "chmod -R 700 $mountDir",
diff --git a/app/Console/Commands/Init.php b/app/Console/Commands/Init.php
index 4f3a808df1..f087002da1 100644
--- a/app/Console/Commands/Init.php
+++ b/app/Console/Commands/Init.php
@@ -110,10 +110,10 @@ class Init extends Command
             $interruptedStartCount = ResourceStartActivity::failInterrupted();
 
             if ($interruptedStartCount > 0) {
-                echo "Marked {$interruptedStartCount} interrupted database/service starts as failed\n";
+                echo "Marked {$interruptedStartCount} interrupted database/service starts and database imports as failed\n";
             }
         } catch (\Throwable $e) {
-            echo "Could not cleanup interrupted database/service starts: {$e->getMessage()}\n";
+            echo "Could not cleanup interrupted database/service starts and database imports: {$e->getMessage()}\n";
         }
 
         try {
diff --git a/app/Http/Controllers/Api/DatabasesController.php b/app/Http/Controllers/Api/DatabasesController.php
index e702a21a57..4b5f65a599 100644
--- a/app/Http/Controllers/Api/DatabasesController.php
+++ b/app/Http/Controllers/Api/DatabasesController.php
@@ -3360,6 +3360,10 @@ class DatabasesController extends Controller
                 response: 404,
                 ref: '#/components/responses/404',
             ),
+            new OA\Response(
+                response: 409,
+                description: 'Another start, restart or import of this database is already in progress.',
+            ),
         ]
     )]
     public function action_deploy(Request $request)
@@ -3382,6 +3386,9 @@ class DatabasesController extends Controller
         if (str($database->status)->contains('running')) {
             return response()->json(['message' => 'Database is already running.'], 400);
         }
+        if ($busyError = StartDatabase::operationInProgressError($database)) {
+            return response()->json(['message' => $busyError], 409);
+        }
         StartDatabase::dispatch($database);
 
         auditLog('api.database.started', [
@@ -3546,6 +3553,10 @@ class DatabasesController extends Controller
                 response: 404,
                 ref: '#/components/responses/404',
             ),
+            new OA\Response(
+                response: 409,
+                description: 'Another start, restart or import of this database is already in progress.',
+            ),
         ]
     )]
     public function action_restart(Request $request)
@@ -3565,6 +3576,9 @@ class DatabasesController extends Controller
 
         $this->authorize('manage', $database);
 
+        if ($busyError = StartDatabase::operationInProgressError($database)) {
+            return response()->json(['message' => $busyError], 409);
+        }
         RestartDatabase::dispatch($database);
 
         auditLog('api.database.restarted', [
diff --git a/app/Http/Controllers/Api/GithubController.php b/app/Http/Controllers/Api/GithubController.php
index 5a0e74d0d9..85238e799b 100644
--- a/app/Http/Controllers/Api/GithubController.php
+++ b/app/Http/Controllers/Api/GithubController.php
@@ -219,8 +219,8 @@ class GithubController extends Controller
         $validator = customApiValidator($request->all(), [
             'name' => 'required|string|max:255',
             'organization' => ['nullable', 'string', 'max:255', 'regex:/\A[^\s\/?#]+\z/'],
-            'api_url' => ['nullable', 'string', 'url', new SafeExternalUrl],
-            'html_url' => ['required', 'string', 'url', new SafeExternalUrl],
+            'api_url' => ['nullable', 'string', 'url', SafeExternalUrl::forGitSource()],
+            'html_url' => ['required', 'string', 'url', SafeExternalUrl::forGitSource()],
             'custom_user' => 'nullable|string|max:255',
             'custom_port' => 'nullable|integer|min:1|max:65535',
             'app_id' => 'required|integer',
@@ -615,10 +615,10 @@ class GithubController extends Controller
                 $rules['organization'] = ['nullable', 'string', 'regex:/\A[^\s\/?#]+\z/'];
             }
             if (isset($payload['api_url'])) {
-                $rules['api_url'] = ['url', new SafeExternalUrl];
+                $rules['api_url'] = ['url', SafeExternalUrl::forGitSource()];
             }
             if (isset($payload['html_url'])) {
-                $rules['html_url'] = ['url', new SafeExternalUrl];
+                $rules['html_url'] = ['url', SafeExternalUrl::forGitSource()];
             }
             if (isset($payload['custom_user'])) {
                 $rules['custom_user'] = 'string';
diff --git a/app/Http/Controllers/Webhook/Bitbucket.php b/app/Http/Controllers/Webhook/Bitbucket.php
index 7b252c5201..ced9a7a05c 100644
--- a/app/Http/Controllers/Webhook/Bitbucket.php
+++ b/app/Http/Controllers/Webhook/Bitbucket.php
@@ -20,10 +20,6 @@ class Bitbucket extends Controller
 
     public function manual(Request $request)
     {
-        if ($this->hasTooManyManualWebhookFailures($request, 'bitbucket')) {
-            return $this->tooManyManualWebhookFailuresResponse($request, 'bitbucket');
-        }
-
         try {
             $return_payloads = collect([]);
             $payload = $request->collect();
@@ -76,9 +72,13 @@ class Bitbucket extends Controller
                     'message' => 'Nothing to do. Invalid repository.',
                 ]);
             }
+            $failure_key = $this->manualWebhookFailureRateLimitKey($request, 'bitbucket', $full_name, $branch);
+            if ($this->hasTooManyManualWebhookFailures($failure_key)) {
+                return $this->tooManyManualWebhookFailuresResponse($failure_key);
+            }
             $applications = $this->manualWebhookApplications(Application::query()->where('git_branch', $branch), $full_name);
             if ($applications->isEmpty()) {
-                return $this->unauthenticatedManualWebhookResponse($request, 'bitbucket');
+                return $this->unauthenticatedManualWebhookResponse($failure_key);
             }
             foreach ($applications as $application) {
                 $webhook_secret = data_get($application, 'manual_webhook_secret_bitbucket');
@@ -279,7 +279,7 @@ class Bitbucket extends Controller
                 }
             }
 
-            return $this->manualWebhookResponse($return_payloads, $request, 'bitbucket');
+            return $this->manualWebhookResponse($return_payloads, $failure_key);
         } catch (Exception $e) {
             return handleError($e);
         }
diff --git a/app/Http/Controllers/Webhook/Concerns/MatchesManualWebhookApplications.php b/app/Http/Controllers/Webhook/Concerns/MatchesManualWebhookApplications.php
index 080b4a1725..b987da88c5 100644
--- a/app/Http/Controllers/Webhook/Concerns/MatchesManualWebhookApplications.php
+++ b/app/Http/Controllers/Webhook/Concerns/MatchesManualWebhookApplications.php
@@ -4,7 +4,6 @@ namespace App\Http\Controllers\Webhook\Concerns;
 
 use App\Models\Application;
 use Illuminate\Database\Eloquent\Builder;
-use Illuminate\Http\Request;
 use Illuminate\Http\Response;
 use Illuminate\Support\Collection;
 
@@ -68,20 +67,25 @@ trait MatchesManualWebhookApplications
     /**
      * Respond to a delivery that could not be authenticated (no matching
      * application or no signature) and count it as a failed attempt.
+     *
+     * Deliveries without a matching application are counted too: the failure
+     * key is scoped to the repository and branch, so this cannot lock out other
+     * applications, and it keeps the 429 response from revealing which
+     * repositories exist in this instance.
      */
-    protected function unauthenticatedManualWebhookResponse(Request $request, string $provider): Response
+    protected function unauthenticatedManualWebhookResponse(string $failureKey): Response
     {
-        $this->recordManualWebhookFailure($request, $provider);
+        $this->recordManualWebhookFailure($failureKey);
 
         return response([$this->unauthenticatedManualWebhookFailurePayload()]);
     }
 
-    protected function manualWebhookResponse(Collection $payloads, Request $request, string $provider): Response
+    protected function manualWebhookResponse(Collection $payloads, string $failureKey): Response
     {
         $failure = $this->unauthenticatedManualWebhookFailurePayload();
         $authorizedPayloads = $payloads->reject(fn (array $payload): bool => $payload === $failure)->values();
         if ($authorizedPayloads->isEmpty() && $payloads->isNotEmpty()) {
-            return $this->unauthenticatedManualWebhookResponse($request, $provider);
+            return $this->unauthenticatedManualWebhookResponse($failureKey);
         }
 
         return response($authorizedPayloads);
diff --git a/app/Http/Controllers/Webhook/Concerns/ThrottlesManualWebhookFailures.php b/app/Http/Controllers/Webhook/Concerns/ThrottlesManualWebhookFailures.php
index fe2832eb1a..e86684b9f6 100644
--- a/app/Http/Controllers/Webhook/Concerns/ThrottlesManualWebhookFailures.php
+++ b/app/Http/Controllers/Webhook/Concerns/ThrottlesManualWebhookFailures.php
@@ -9,9 +9,12 @@ use Illuminate\Support\Facades\RateLimiter;
 /**
  * Throttles manual webhook deliveries that fail authentication.
  *
- * Only failed authentication attempts are counted, per provider and client IP,
- * so valid signed deliveries from shared IPs (Cloudflare, Git host IP pools)
- * are never dropped because of unrelated traffic.
+ * Failures are counted per provider, client IP, repository and branch filter.
+ * The repository and branch come from the payload and select the applications
+ * whose secrets are checked, so a guesser can only exhaust the bucket of the
+ * applications it targets. Git hosts deliver from shared egress IPs; one
+ * misconfigured repository (wrong secret, deleted application, untracked
+ * branch) therefore cannot lock out deliveries for other repositories.
  */
 trait ThrottlesManualWebhookFailures
 {
@@ -19,19 +22,28 @@ trait ThrottlesManualWebhookFailures
 
     protected const int MANUAL_WEBHOOK_FAILURE_DECAY_SECONDS = 60;
 
-    protected function manualWebhookFailureRateLimitKey(Request $request, string $provider): string
+    /**
+     * @param  string  $fullName  Canonical repository path from manualWebhookRepositoryFullName().
+     * @param  mixed  $branch  Branch used to select applications, or null when all branches match.
+     */
+    protected function manualWebhookFailureRateLimitKey(Request $request, string $provider, string $fullName, mixed $branch): string
     {
-        return "manual-webhook-failures:{$provider}:".auth_rate_limit_ip($request);
+        $scope = json_encode([
+            mb_strtolower($fullName),
+            is_scalar($branch) ? (string) $branch : null,
+        ]);
+
+        return "manual-webhook-failures:{$provider}:".auth_rate_limit_ip($request).':'.hash('sha256', (string) $scope);
     }
 
-    protected function hasTooManyManualWebhookFailures(Request $request, string $provider): bool
+    protected function hasTooManyManualWebhookFailures(string $failureKey): bool
     {
-        return RateLimiter::tooManyAttempts($this->manualWebhookFailureRateLimitKey($request, $provider), self::MANUAL_WEBHOOK_MAX_FAILURES);
+        return RateLimiter::tooManyAttempts($failureKey, self::MANUAL_WEBHOOK_MAX_FAILURES);
     }
 
-    protected function tooManyManualWebhookFailuresResponse(Request $request, string $provider): Response
+    protected function tooManyManualWebhookFailuresResponse(string $failureKey): Response
     {
-        $retryAfter = RateLimiter::availableIn($this->manualWebhookFailureRateLimitKey($request, $provider));
+        $retryAfter = RateLimiter::availableIn($failureKey);
 
         return response([
             'status' => 'failed',
@@ -39,8 +51,8 @@ trait ThrottlesManualWebhookFailures
         ], 429)->header('Retry-After', (string) max($retryAfter, 1));
     }
 
-    protected function recordManualWebhookFailure(Request $request, string $provider): void
+    protected function recordManualWebhookFailure(string $failureKey): void
     {
-        RateLimiter::hit($this->manualWebhookFailureRateLimitKey($request, $provider), self::MANUAL_WEBHOOK_FAILURE_DECAY_SECONDS);
+        RateLimiter::hit($failureKey, self::MANUAL_WEBHOOK_FAILURE_DECAY_SECONDS);
     }
 }
diff --git a/app/Http/Controllers/Webhook/Gitea.php b/app/Http/Controllers/Webhook/Gitea.php
index 975e990973..40f015b41d 100644
--- a/app/Http/Controllers/Webhook/Gitea.php
+++ b/app/Http/Controllers/Webhook/Gitea.php
@@ -21,10 +21,6 @@ class Gitea extends Controller
 
     public function manual(Request $request)
     {
-        if ($this->hasTooManyManualWebhookFailures($request, 'gitea')) {
-            return $this->tooManyManualWebhookFailuresResponse($request, 'gitea');
-        }
-
         try {
             $return_payloads = collect([]);
             $x_gitea_delivery = request()->header('X-Gitea-Delivery');
@@ -69,17 +65,22 @@ class Gitea extends Controller
             if ($full_name === null) {
                 return response('Nothing to do. Invalid repository.');
             }
+            $matched_branch = $x_gitea_event === 'pull_request' ? $base_branch : $branch;
+            $failure_key = $this->manualWebhookFailureRateLimitKey($request, 'gitea', $full_name, $matched_branch);
+            if ($this->hasTooManyManualWebhookFailures($failure_key)) {
+                return $this->tooManyManualWebhookFailuresResponse($failure_key);
+            }
             $applications = Application::query();
             if ($x_gitea_event === 'push') {
                 $applications = $this->manualWebhookApplications($applications->where('git_branch', $branch), $full_name);
                 if ($applications->isEmpty()) {
-                    return $this->unauthenticatedManualWebhookResponse($request, 'gitea');
+                    return $this->unauthenticatedManualWebhookResponse($failure_key);
                 }
             }
             if ($x_gitea_event === 'pull_request') {
                 $applications = $this->manualWebhookApplications($applications->where('git_branch', $base_branch), $full_name);
                 if ($applications->isEmpty()) {
-                    return $this->unauthenticatedManualWebhookResponse($request, 'gitea');
+                    return $this->unauthenticatedManualWebhookResponse($failure_key);
                 }
             }
             foreach ($applications as $application) {
@@ -285,7 +286,7 @@ class Gitea extends Controller
                 }
             }
 
-            return $this->manualWebhookResponse($return_payloads, $request, 'gitea');
+            return $this->manualWebhookResponse($return_payloads, $failure_key);
         } catch (Exception $e) {
             return handleError($e);
         }
diff --git a/app/Http/Controllers/Webhook/Github.php b/app/Http/Controllers/Webhook/Github.php
index e00c9cf4a4..fb85b148ef 100644
--- a/app/Http/Controllers/Webhook/Github.php
+++ b/app/Http/Controllers/Webhook/Github.php
@@ -25,10 +25,6 @@ class Github extends Controller
 
     public function manual(Request $request)
     {
-        if ($this->hasTooManyManualWebhookFailures($request, 'github')) {
-            return $this->tooManyManualWebhookFailuresResponse($request, 'github');
-        }
-
         try {
             $return_payloads = collect([]);
             $x_github_delivery = request()->header('X-GitHub-Delivery');
@@ -79,21 +75,22 @@ class Github extends Controller
             if ($full_name === null) {
                 return response('Nothing to do. Invalid repository.');
             }
-            $applications = Application::query();
-            if ($x_github_event === 'push') {
-                $applications = $this->manualWebhookApplications($applications->where('git_branch', $branch), $full_name);
-                if ($applications->isEmpty()) {
-                    return $this->unauthenticatedManualWebhookResponse($request, 'github');
-                }
+            $matched_branch = match (true) {
+                $x_github_event === 'push' => $branch,
+                $action === 'closed' => null,
+                default => $base_branch,
+            };
+            $failure_key = $this->manualWebhookFailureRateLimitKey($request, 'github', $full_name, $matched_branch);
+            if ($this->hasTooManyManualWebhookFailures($failure_key)) {
+                return $this->tooManyManualWebhookFailuresResponse($failure_key);
             }
-            if ($x_github_event === 'pull_request') {
-                if ($action !== 'closed') {
-                    $applications->where('git_branch', $base_branch);
-                }
-                $applications = $this->manualWebhookApplications($applications, $full_name);
-                if ($applications->isEmpty()) {
-                    return $this->unauthenticatedManualWebhookResponse($request, 'github');
-                }
+            $applications = Application::query();
+            if ($x_github_event === 'push' || $action !== 'closed') {
+                $applications->where('git_branch', $matched_branch);
+            }
+            $applications = $this->manualWebhookApplications($applications, $full_name);
+            if ($applications->isEmpty()) {
+                return $this->unauthenticatedManualWebhookResponse($failure_key);
             }
             $applicationsByServer = $applications->groupBy(function ($app) {
                 return $app->destination->server_id;
@@ -243,7 +240,7 @@ class Github extends Controller
                 }
             }
 
-            return $this->manualWebhookResponse($return_payloads, $request, 'github');
+            return $this->manualWebhookResponse($return_payloads, $failure_key);
         } catch (Exception $e) {
             return handleError($e);
         }
diff --git a/app/Http/Controllers/Webhook/Gitlab.php b/app/Http/Controllers/Webhook/Gitlab.php
index e95a98b230..2eec721bb9 100644
--- a/app/Http/Controllers/Webhook/Gitlab.php
+++ b/app/Http/Controllers/Webhook/Gitlab.php
@@ -336,10 +336,6 @@ class Gitlab extends Controller
 
     public function manual(Request $request)
     {
-        if ($this->hasTooManyManualWebhookFailures($request, 'gitlab')) {
-            return $this->tooManyManualWebhookFailuresResponse($request, 'gitlab');
-        }
-
         try {
             $return_payloads = collect([]);
             $payload = $request->collect();
@@ -356,12 +352,14 @@ class Gitlab extends Controller
                 return response($return_payloads);
             }
 
+            // A delivery without a token does not try a secret, so it is not
+            // counted as a failed attempt.
             if (empty($x_gitlab_token)) {
                 auditLogWebhookFailure('gitlab', 'webhook_token_missing', [
                     'event' => $x_gitlab_event,
                 ]);
 
-                return $this->unauthenticatedManualWebhookResponse($request, 'gitlab');
+                return response([$this->unauthenticatedManualWebhookFailurePayload()]);
             }
 
             if ($x_gitlab_event === 'push') {
@@ -412,17 +410,22 @@ class Gitlab extends Controller
 
                 return response($return_payloads);
             }
+            $matched_branch = $x_gitlab_event === 'merge_request' ? $base_branch : $branch;
+            $failure_key = $this->manualWebhookFailureRateLimitKey($request, 'gitlab', $full_name, $matched_branch);
+            if ($this->hasTooManyManualWebhookFailures($failure_key)) {
+                return $this->tooManyManualWebhookFailuresResponse($failure_key);
+            }
             $applications = Application::query();
             if ($x_gitlab_event === 'push') {
                 $applications = $this->manualWebhookApplications($applications->where('git_branch', $branch), $full_name);
                 if ($applications->isEmpty()) {
-                    return $this->unauthenticatedManualWebhookResponse($request, 'gitlab');
+                    return $this->unauthenticatedManualWebhookResponse($failure_key);
                 }
             }
             if ($x_gitlab_event === 'merge_request') {
                 $applications = $this->manualWebhookApplications($applications->where('git_branch', $base_branch), $full_name);
                 if ($applications->isEmpty()) {
-                    return $this->unauthenticatedManualWebhookResponse($request, 'gitlab');
+                    return $this->unauthenticatedManualWebhookResponse($failure_key);
                 }
             }
             foreach ($applications as $application) {
@@ -631,7 +634,7 @@ class Gitlab extends Controller
                 }
             }
 
-            return $this->manualWebhookResponse($return_payloads, $request, 'gitlab');
+            return $this->manualWebhookResponse($return_payloads, $failure_key);
         } catch (Exception $e) {
             return handleError($e);
         }
diff --git a/app/Jobs/ApplicationDeploymentJob.php b/app/Jobs/ApplicationDeploymentJob.php
index db704f1dc4..810f3336c9 100644
--- a/app/Jobs/ApplicationDeploymentJob.php
+++ b/app/Jobs/ApplicationDeploymentJob.php
@@ -769,6 +769,7 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
         $this->execute_remote_command([
             executeInDocker($this->deployment_uuid, "echo '{$this->docker_compose_base64}' | base64 -d | tee {$this->workdir}{$this->docker_compose_location} > /dev/null"),
             'hidden' => true,
+            'skip_command_log' => true,
         ]);
 
         // Modify Dockerfiles for ARGs and build secrets
@@ -1151,6 +1152,7 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
                 ],
                 [
                     "echo '{$this->docker_compose_base64}' | base64 -d | tee $composeFileName > /dev/null",
+                    'skip_command_log' => true,
                 ],
                 [
                     "echo '{$readme}' > $mainDir/README.md",
@@ -1774,12 +1776,7 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
         );
 
         if (isDev()) {
-            $this->execute_remote_command(
-                [
-                    executeInDocker($this->deployment_uuid, "cat $this->workdir/.env"),
-                    'hidden' => true,
-                ]
-            );
+            $this->logEnvironmentFileKeys("{$this->workdir}/.env", $environment_variables);
         }
 
         // Write .env file to configuration directory
@@ -1802,6 +1799,20 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
         }
     }
 
+    /**
+     * Development aid: log which variables an env file contains, without their values.
+     *
+     * @param  Collection<int, string>  $environmentVariables  Lines in KEY=VALUE format.
+     */
+    private function logEnvironmentFileKeys(string $path, Collection $environmentVariables): void
+    {
+        $keys = $environmentVariables
+            ->map(fn (string $line): string => explode('=', $line, 2)[0])
+            ->implode(', ');
+
+        $this->application_deployment_queue->addLogEntry("[DEBUG] Variable names in {$path}: {$keys}", hidden: true);
+    }
+
     private function generate_buildtime_environment_variables()
     {
         if (isDev()) {
@@ -2067,38 +2078,60 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
     }
 
     /**
-     * Build-time names go into shell and Docker build commands, so they must be valid. Runtime-only
-     * variables only go into the .env file: existing ones with names that new variables can no longer
-     * use (such as my-var) keep working, unless the name would break a .env line.
+     * Build-time names go into shell and Docker build commands, so they must be valid when the
+     * deployment builds an image. Runtime-only variables only go into the .env file: existing ones
+     * with names that new variables can no longer use (such as my-var) keep working, unless the
+     * name would break a .env line. Deployments without a build step (Docker image) treat
+     * build-time variables the same way, because no build receives them.
      */
     private function validateDeploymentEnvironmentVariableKeys(): void
     {
         $environmentVariables = $this->pull_request_id === 0
-            ? $this->application->environment_variables()->get(['key', 'is_buildtime'])
-            : $this->application->environment_variables_preview()->get(['key', 'is_buildtime']);
+            ? $this->application->environment_variables()->get(['key', 'is_buildtime', 'is_runtime'])
+            : $this->application->environment_variables_preview()->get(['key', 'is_buildtime', 'is_runtime']);
+        $passesBuildtimeVariables = $this->deploymentPassesBuildtimeVariables();
 
         foreach ($environmentVariables as $environmentVariable) {
             $key = (string) $environmentVariable->key;
             $isEnvFileSafe = $key !== '' && strpbrk($key, "=\n\r\0") === false;
-            if ($environmentVariable->is_buildtime || ! $isEnvFileSafe) {
+            if (($environmentVariable->is_buildtime && $passesBuildtimeVariables) || ! $isEnvFileSafe) {
                 $this->validatedBuildtimeEnvironmentVariableKey($key, 'the deployment environment');
 
                 continue;
             }
             if (! ValidationPatterns::isValidEnvironmentVariableKey($key)) {
-                $this->logLegacyRuntimeEnvironmentVariableKey($key);
+                $this->logLegacyEnvironmentVariableKey($key, (bool) $environmentVariable->is_buildtime, (bool) $environmentVariable->is_runtime);
             }
         }
     }
 
-    private function logLegacyRuntimeEnvironmentVariableKey(string $key): void
+    /**
+     * Only Docker image deployments never build an image. Other deployments (also restarts,
+     * rollbacks, and previews) can build and pass build-time variables to the build.
+     */
+    private function deploymentPassesBuildtimeVariables(): bool
+    {
+        return $this->application->build_pack !== 'dockerimage';
+    }
+
+    private function logLegacyEnvironmentVariableKey(string $key, bool $isBuildtime, bool $isRuntime): void
     {
         $suggestedKey = (string) preg_replace('/[^A-Za-z0-9_]/', '_', $key);
         if (preg_match('/\A[0-9]/', $suggestedKey) === 1) {
             $suggestedKey = '_'.$suggestedKey;
         }
 
-        $this->application_deployment_queue->addLogEntry('⚠️ Runtime variable '.ValidationPatterns::displayShellEnvironmentVariableKey($key).' uses a name that new variables cannot use. It is still passed to the container, but shell scripts cannot read it.', 'stderr');
+        $displayKey = ValidationPatterns::displayShellEnvironmentVariableKey($key);
+
+        if ($isBuildtime) {
+            $this->application_deployment_queue->addLogEntry("⚠️ Build-time variable {$displayKey} uses a name that new variables cannot use. This deployment does not build an image, so it is not used as a build-time variable. Rename it before you use it in a build.", 'stderr');
+        }
+        if ($isRuntime) {
+            $this->application_deployment_queue->addLogEntry("⚠️ Runtime variable {$displayKey} uses a name that new variables cannot use. It is still passed to the container, but shell scripts cannot read it.", 'stderr');
+        }
+        if (! $isBuildtime && ! $isRuntime) {
+            $this->application_deployment_queue->addLogEntry("⚠️ Variable {$displayKey} uses a name that new variables cannot use. This deployment does not use it.", 'stderr');
+        }
         $this->application_deployment_queue->addLogEntry('   Suggested name: '.ValidationPatterns::displayShellEnvironmentVariableKey($suggestedKey), type: 'info');
     }
 
@@ -2159,10 +2192,7 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
                 ]);
 
                 if (isDev()) {
-                    $this->execute_remote_command([
-                        executeInDocker($this->deployment_uuid, 'cat '.self::BUILD_TIME_ENV_PATH),
-                        'hidden' => true,
-                    ]);
+                    $this->logEnvironmentFileKeys(self::BUILD_TIME_ENV_PATH, $environment_variables);
                 }
             } elseif (in_array($this->build_pack, ['dockercompose', 'dockerfile', 'railpack'], true)) {
                 $this->application_deployment_queue->addLogEntry('Creating empty build-time .env file in /artifacts (no build-time variables defined).', hidden: true);
@@ -2527,6 +2557,7 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
             [
                 $runCommand,
                 'hidden' => true,
+                'skip_command_log' => filled($env_flags),
             ],
             [
                 'command' => executeInDocker($this->deployment_uuid, "mkdir -p {$this->basedir}"),
@@ -3325,7 +3356,7 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
 
         $this->application_deployment_queue->addLogEntry('Generating Railpack build plan.');
         $this->execute_remote_command(
-            [executeInDocker($this->deployment_uuid, $prepare_command), 'hidden' => true],
+            [executeInDocker($this->deployment_uuid, $prepare_command), 'hidden' => true, 'skip_command_log' => true],
             [
                 executeInDocker($this->deployment_uuid, 'cat /artifacts/railpack-plan.json'),
                 'hidden' => true,
@@ -3813,7 +3844,7 @@ COPY ./nginx.conf /etc/nginx/conf.d/default.conf");
 
         $this->docker_compose = Yaml::dump($docker_compose, 10);
         $this->docker_compose_base64 = base64_encode($this->docker_compose);
-        $this->execute_remote_command([executeInDocker($this->deployment_uuid, "echo '{$this->docker_compose_base64}' | base64 -d | tee {$this->workdir}/docker-compose.yaml > /dev/null"), 'hidden' => true]);
+        $this->execute_remote_command([executeInDocker($this->deployment_uuid, "echo '{$this->docker_compose_base64}' | base64 -d | tee {$this->workdir}/docker-compose.yaml > /dev/null"), 'hidden' => true, 'skip_command_log' => true]);
     }
 
     private function generate_local_persistent_volumes()
@@ -4044,7 +4075,7 @@ COPY ./nginx.conf /etc/nginx/conf.d/default.conf");
             }
             if ($this->application->build_pack === 'nixpacks') {
                 $this->nixpacks_plan = base64_encode($this->nixpacks_plan);
-                $this->execute_remote_command([executeInDocker($this->deployment_uuid, "echo '{$this->nixpacks_plan}' | base64 -d | tee ".self::NIXPACKS_PLAN_PATH.' > /dev/null'), 'hidden' => true]);
+                $this->execute_remote_command([executeInDocker($this->deployment_uuid, "echo '{$this->nixpacks_plan}' | base64 -d | tee ".self::NIXPACKS_PLAN_PATH.' > /dev/null'), 'hidden' => true, 'skip_command_log' => true]);
                 if ($this->force_rebuild) {
                     $this->execute_remote_command([
                         executeInDocker($this->deployment_uuid, 'nixpacks build -c '.self::NIXPACKS_PLAN_PATH." --no-cache --no-error-without-start -n {$this->build_image_name} {$this->workdir} -o {$this->workdir}"),
@@ -4230,7 +4261,7 @@ COPY ./nginx.conf /etc/nginx/conf.d/default.conf");
             } else {
                 if ($this->application->build_pack === 'nixpacks') {
                     $this->nixpacks_plan = base64_encode($this->nixpacks_plan);
-                    $this->execute_remote_command([executeInDocker($this->deployment_uuid, "echo '{$this->nixpacks_plan}' | base64 -d | tee ".self::NIXPACKS_PLAN_PATH.' > /dev/null'), 'hidden' => true]);
+                    $this->execute_remote_command([executeInDocker($this->deployment_uuid, "echo '{$this->nixpacks_plan}' | base64 -d | tee ".self::NIXPACKS_PLAN_PATH.' > /dev/null'), 'hidden' => true, 'skip_command_log' => true]);
                     if ($this->force_rebuild) {
                         $this->execute_remote_command([
                             executeInDocker($this->deployment_uuid, 'nixpacks build -c '.self::NIXPACKS_PLAN_PATH." --no-cache --no-error-without-start -n {$this->production_image_name} {$this->workdir} -o {$this->workdir}"),
@@ -4579,8 +4610,8 @@ COPY ./nginx.conf /etc/nginx/conf.d/default.conf");
 
     private function generate_docker_env_flags_for_secrets()
     {
-        // Only generate env flags if build secrets are enabled
-        if (! $this->application->settings->use_build_secrets) {
+        // Only generate env flags if build secrets are enabled and the deployment builds an image
+        if (! $this->application->settings->use_build_secrets || ! $this->deploymentPassesBuildtimeVariables()) {
             return '';
         }
 
@@ -4939,7 +4970,7 @@ COPY ./nginx.conf /etc/nginx/conf.d/default.conf");
 
             $dockerfilePath = $this->resolveComposeDockerfilePath($service['build']);
             if ($dockerfilePath === null) {
-                $this->application_deployment_queue->addLogEntry("The build context of service {$serviceName} is remote or uses variables, skipping ARG injection.");
+                $this->application_deployment_queue->addLogEntry($this->composeArgInjectionSkippedMessage((string) $serviceName, $service['build'], $variables));
 
                 continue;
             }
@@ -5097,6 +5128,41 @@ COPY ./nginx.conf /etc/nginx/conf.d/default.conf");
         return str_starts_with($dockerfile, '/') ? $dockerfile : rtrim($context, '/').'/'.$dockerfile;
     }
 
+    /**
+     * Tells the user why Coolify cannot add ARG lines to a Compose service Dockerfile, and which
+     * build-time variables to declare there. Only valid variable names are shown, never values.
+     *
+     * @param  Collection<string, mixed>  $variables
+     */
+    private function composeArgInjectionSkippedMessage(string $serviceName, mixed $build, Collection $variables): string
+    {
+        $context = is_string($build) ? $build : data_get($build, 'context');
+        $dockerfile = is_array($build) ? data_get($build, 'dockerfile') : null;
+
+        $reason = match (true) {
+            is_array($build) && array_key_exists('dockerfile_inline', $build) => 'the service uses an inline Dockerfile (dockerfile_inline)',
+            is_string($context) && preg_match('~^[a-z][a-z0-9+.-]*://|^git@~i', $context) === 1 => 'the build context is a remote Git URL',
+            (is_string($context) && str_contains($context, '$')) || (is_string($dockerfile) && str_contains($dockerfile, '$')) => 'the build context or Dockerfile path uses variables',
+            default => 'Coolify cannot read the build definition',
+        };
+
+        $names = $variables->keys()
+            ->map(fn ($key) => (string) $key)
+            ->filter(fn (string $key) => ValidationPatterns::isValidEnvironmentVariableKey($key))
+            ->sortBy(fn (string $key) => str_starts_with($key, 'COOLIFY_') ? 1 : 0)
+            ->values();
+
+        $message = "Skipping ARG injection for service {$serviceName}: {$reason}. Docker ignores build-time variables that the Dockerfile does not declare, so add 'ARG <NAME>' lines to the Dockerfile for the ones you need";
+        if ($names->isEmpty()) {
+            return "{$message}.";
+        }
+
+        $listedNames = $names->take(10)->implode(', ');
+        $moreCount = $names->count() - 10;
+
+        return $moreCount > 0 ? "{$message}: {$listedNames} and {$moreCount} more." : "{$message}: {$listedNames}.";
+    }
+
     private function add_build_secrets_to_compose($composeFile)
     {
         // Generate env variables if not already done
diff --git a/app/Jobs/DatabaseStartJob.php b/app/Jobs/DatabaseStartJob.php
index 5bbd35b9c7..4ec5630935 100644
--- a/app/Jobs/DatabaseStartJob.php
+++ b/app/Jobs/DatabaseStartJob.php
@@ -27,9 +27,11 @@ use App\Support\ResourceStartActivity;
 use Illuminate\Bus\Queueable;
 use Illuminate\Contracts\Queue\ShouldBeEncrypted;
 use Illuminate\Contracts\Queue\ShouldQueue;
+use Illuminate\Database\Eloquent\Model;
 use Illuminate\Foundation\Bus\Dispatchable;
 use Illuminate\Queue\InteractsWithQueue;
 use Illuminate\Queue\SerializesModels;
+use Illuminate\Support\Facades\Cache;
 use Spatie\Activitylog\Models\Activity;
 use Throwable;
 
@@ -57,6 +59,60 @@ class DatabaseStartJob implements ShouldBeEncrypted, ShouldQueue
         abort_unless((int) $database->team()->id === $this->teamId, 403);
         $activity = Activity::query()->findOrFail($this->activityId);
 
+        if (! $this->isStillRequested($activity, $database->uuid)) {
+            event(new DatabaseStatusChanged($this->userId));
+
+            return;
+        }
+
+        $lock = Cache::lock(ResourceStartActivity::databaseStartLockKey($database->uuid), ResourceStartActivity::DATABASE_START_LOCK_SECONDS);
+        if (! $lock->get()) {
+            ResourceStartActivity::markFailed($activity, ResourceStartActivity::ALREADY_STARTING_MESSAGE);
+            event(new DatabaseStatusChanged($this->userId));
+
+            return;
+        }
+
+        try {
+            $this->runStart($database, $activity);
+        } finally {
+            $lock->release();
+        }
+    }
+
+    /**
+     * A start runs only while its activity is still queued and no newer start of the same
+     * database was requested. A start that waited in a busy queue can be treated as stale and
+     * replaced by a new one; without this check both would run one after the other.
+     */
+    private function isStillRequested(Activity $activity, string $databaseUuid): bool
+    {
+        if (data_get($activity, 'properties.status') !== ProcessStatus::QUEUED->value) {
+            return false;
+        }
+
+        $newerStartExists = Activity::query()
+            ->where('properties->type_uuid', $databaseUuid)
+            ->where('properties->operation', ResourceStartActivity::DATABASE_START_OPERATION)
+            ->whereIn('properties->status', [
+                ProcessStatus::QUEUED->value,
+                ProcessStatus::IN_PROGRESS->value,
+                ProcessStatus::FINISHED->value,
+            ])
+            ->where('id', '>', $activity->getKey())
+            ->exists();
+
+        if ($newerStartExists) {
+            ResourceStartActivity::markFailed($activity, ResourceStartActivity::SUPERSEDED_MESSAGE);
+
+            return false;
+        }
+
+        return true;
+    }
+
+    private function runStart(Model $database, Activity $activity): void
+    {
         $result = match ($database->getMorphClass()) {
             StandalonePostgresql::class => StartPostgresql::run($database, $activity),
             StandaloneRedis::class => StartRedis::run($database, $activity),
diff --git a/app/Livewire/Analytics.php b/app/Livewire/Analytics.php
index be5d603eeb..2ebc6dc78f 100644
--- a/app/Livewire/Analytics.php
+++ b/app/Livewire/Analytics.php
@@ -5,8 +5,10 @@ namespace App\Livewire;
 use App\Livewire\Concerns\BuildsTrafficChartPayload;
 use App\Models\Application;
 use App\Models\Server;
+use App\Models\Service;
 use App\Services\SentinelTrafficClient;
 use App\Services\TrafficAnalyticsAggregator;
+use App\Services\TrafficResource;
 use Illuminate\Contracts\View\View;
 use Illuminate\Support\Collection;
 use Illuminate\Support\Facades\Log;
@@ -30,12 +32,12 @@ class Analytics extends Component
     /** @var array<string, string> uuid => name, for the server filter */
     public array $serverOptions = [];
 
-    /** @var array<string, string> uuid => name, for the application filter (scoped to the selected server) */
+    /** @var array<string, string> uuid => name, for the application/service filter (scoped to the selected server) */
     public array $appOptions = [];
 
     /**
-     * Listbox options for the application filter, grouped under project headers so
-     * it's clear which application belongs to which project.
+     * Listbox options for the application/service filter, grouped under project headers so
+     * it's clear which resource belongs to which project. Services carry a "(Service)" suffix.
      *
      * @var array<int, array{value: string, label: string, header?: bool}>
      */
@@ -105,13 +107,21 @@ class Analytics extends Component
     protected array $breakdownDimensions = ['country', 'referer', 'browser', 'os', 'device', 'protocol', 'cache', 'status', 'agent', 'ip', 'useragent'];
 
     /**
-     * Per-request cache of app uuid => display metadata, so resolving a name/domain/link
-     * for the leaderboard and path domains hits the DB at most once per app.
+     * Per-request cache of Sentinel key => display metadata, so resolving a name/domain/link
+     * for the leaderboard and path domains runs at most once per key.
      *
-     * @var array<string, array{name: string, domain: ?string, link: ?string}>
+     * @var array<string, array{uuid: string, name: string, domain: ?string, rowDomain: ?string, link: ?string, isService: bool}>
      */
     protected array $appMetaCache = [];
 
+    /**
+     * Per-request map of every team Application and Service by uuid; the only source used
+     * to name Sentinel keys, so a key never resolves to another team's resource.
+     *
+     * @var array<string, TrafficResource>|null
+     */
+    protected ?array $teamResources = null;
+
     public function mount(?string $scopedServerUuid = null): void
     {
         $allServers = Server::ownedByCurrentTeamCached();
@@ -223,9 +233,9 @@ class Analytics extends Component
     {
         $enabledUuids = $this->servers->pluck('uuid');
 
-        $apps = Application::ownedByCurrentTeam()->with(['environment.project', 'destination.server'])->get()
-            ->filter(function (Application $app) use ($enabledUuids): bool {
-                $serverUuid = $app->destination?->server?->uuid;
+        $resources = collect($this->teamResources())
+            ->filter(function (TrafficResource $resource) use ($enabledUuids): bool {
+                $serverUuid = $resource->server()?->uuid;
 
                 if (! $serverUuid || ! $enabledUuids->contains($serverUuid)) {
                     return false;
@@ -235,26 +245,61 @@ class Analytics extends Component
             });
 
         // Flat uuid => name map, used to validate a bookmarked ?app= filter.
-        $options = $apps->mapWithKeys(fn (Application $app) => [$app->uuid => $app->name])->all();
+        $options = $resources->mapWithKeys(fn (TrafficResource $resource) => [$resource->uuid() => $resource->name()])->all();
         asort($options);
         $this->appOptions = $options;
 
-        // Grouped listbox options: a header row per project, then its apps (both alpha-sorted).
+        // Grouped listbox options: a header row per project, then its applications and
+        // services (both alpha-sorted by name).
         $grouped = [];
-        $byProject = $apps
-            ->groupBy(fn (Application $app) => (string) (data_get($app, 'environment.project.name') ?: 'Ungrouped'))
+        $byProject = $resources
+            ->groupBy(fn (TrafficResource $resource) => $resource->projectName())
             ->sortKeys();
 
-        foreach ($byProject as $projectName => $projectApps) {
+        foreach ($byProject as $projectName => $projectResources) {
             $grouped[] = ['value' => '__group_'.md5($projectName), 'label' => $projectName, 'header' => true];
-            foreach ($projectApps->sortBy('name') as $app) {
-                $grouped[] = ['value' => $app->uuid, 'label' => $app->name];
+            foreach ($projectResources->sortBy(fn (TrafficResource $resource) => $resource->name()) as $resource) {
+                $grouped[] = [
+                    'value' => $resource->uuid(),
+                    'label' => $resource->isService() ? $resource->name().' (Service)' : $resource->name(),
+                ];
             }
         }
 
         $this->appGroupedOptions = $grouped;
     }
 
+    /**
+     * Every Application and Service of the current team, keyed by uuid. Loaded once per
+     * request with the relations the filter, links, and domain lookups need.
+     *
+     * @return array<string, TrafficResource>
+     */
+    protected function teamResources(): array
+    {
+        if ($this->teamResources !== null) {
+            return $this->teamResources;
+        }
+
+        $resources = [];
+        foreach (Application::ownedByCurrentTeam()->with(['environment.project', 'destination.server'])->get() as $application) {
+            $resources[$application->uuid] = TrafficResource::for($application);
+        }
+        foreach (Service::ownedByCurrentTeam()->with(['environment.project', 'server', 'applications'])->get() as $service) {
+            $resources[$service->uuid] = TrafficResource::for($service);
+        }
+
+        return $this->teamResources = $resources;
+    }
+
+    /**
+     * The team resource selected in the application/service filter, or null.
+     */
+    protected function selectedResource(): ?TrafficResource
+    {
+        return $this->appUuid !== '' ? ($this->teamResources()[$this->appUuid] ?? null) : null;
+    }
+
     /**
      * Servers this view should query, honoring the active server/app filters.
      */
@@ -265,8 +310,7 @@ class Analytics extends Component
         }
 
         if ($this->appUuid !== '') {
-            $server = Application::ownedByCurrentTeam()->whereUuid($this->appUuid)->first()
-                ?->destination?->server;
+            $server = $this->selectedResource()?->server();
 
             return $server && $this->servers->contains(fn (Server $s) => $s->uuid === $server->uuid)
                 ? collect([$server])
@@ -287,111 +331,73 @@ class Analytics extends Component
         }
 
         [$from, $to] = $this->window();
-        $appKey = $this->appUuid !== '' ? $this->appUuid : null;
+        // A selected application or service is queried under all of its Sentinel keys.
+        $resource = $this->selectedResource();
         $servers = $this->targetServers();
+        $domainForKey = fn (string $key): ?string => $this->appMeta($key)['domain'];
 
-        $overviews = [];
+        $aggregator = new TrafficAnalyticsAggregator($this->breakdownDimensions);
         $appRows = [];
-        $pathTotals = [];
-        $breakdownTotals = array_fill_keys($this->breakdownDimensions, []);
-        $seriesByBucket = [];
-        $attribution = null;
+        $hostTotals = [];
 
         foreach ($servers as $server) {
             try {
                 $client = $this->trafficClient($server);
 
+                if ($resource !== null) {
+                    $keys = $client->prefetchResource($resource->uuid(), $from, $to, $this->breakdownDimensions, $this->range);
+                    foreach ($keys as $key) {
+                        $aggregator->collect($client, $key, $from, $to, $this->range, $domainForKey);
+                    }
+
+                    continue;
+                }
+
                 // Warm every server-wide endpoint in one docker exec instead of ~15 serial
                 // SSH round-trips; the per-call methods below then read from cache.
-                $leaderboardUuids = $client->prefetchServerWide($appKey, $from, $to, $this->breakdownDimensions, $this->range, appsLimit: self::MAX_LEADERBOARD_APPS);
+                $leaderboardKeys = $client->prefetchServerWide(null, $from, $to, $this->breakdownDimensions, $this->range, appsLimit: self::MAX_LEADERBOARD_APPS);
 
-                // Per-application leaderboard only makes sense when not already filtered to one app.
-                if ($appKey === null && $leaderboardUuids !== []) {
-                    if (count($leaderboardUuids) > self::MAX_LEADERBOARD_APPS) {
+                if ($leaderboardKeys !== []) {
+                    if (count($leaderboardKeys) > self::MAX_LEADERBOARD_APPS) {
                         Log::warning('Traffic analytics leaderboard truncated', [
                             'server' => $server->uuid,
-                            'total' => count($leaderboardUuids),
+                            'total' => count($leaderboardKeys),
                             'shown' => self::MAX_LEADERBOARD_APPS,
                         ]);
-                        $leaderboardUuids = array_slice($leaderboardUuids, 0, self::MAX_LEADERBOARD_APPS);
+                        $leaderboardKeys = array_slice($leaderboardKeys, 0, self::MAX_LEADERBOARD_APPS);
                     }
-                    // Warm the leaderboard's per-app overviews in a second batched exec.
-                    $client->prefetchAppOverviews($leaderboardUuids, $from, $to);
+                    // Warm the leaderboard's per-key overviews in a second batched exec.
+                    $client->prefetchAppOverviews($leaderboardKeys, $from, $to);
                 }
 
-                $overviews[] = $client->overview($appKey, $from, $to);
+                $aggregator->collect($client, null, $from, $to, $this->range, $domainForKey);
 
-                if ($appKey === null) {
-                    foreach ($leaderboardUuids as $uuid) {
-                        $appOverview = $client->overview($uuid, $from, $to)->toArray();
-                        $meta = $this->appMeta($uuid);
+                // Leaderboard: fold every key into its owning team resource (compose services
+                // and previews into their application or service); unknown keys stay raw.
+                foreach ($leaderboardKeys as $key) {
+                    $keyOverview = $client->overview($key, $from, $to)->toArray();
+                    $requests = (int) ($keyOverview['requests'] ?? 0);
+                    $bandwidth = (int) ($keyOverview['bytesIn'] ?? 0) + (int) ($keyOverview['bytesOut'] ?? 0);
+                    $meta = $this->appMeta($key);
 
-                        $appRows[] = [
-                            'uuid' => $uuid,
-                            'name' => $meta['name'],
-                            'domain' => $meta['domain'],
-                            'link' => $meta['link'],
-                            'requests' => (int) ($appOverview['requests'] ?? 0),
-                            'bandwidth' => (int) ($appOverview['bytesIn'] ?? 0) + (int) ($appOverview['bytesOut'] ?? 0),
-                        ];
-                    }
-                }
+                    $appRows[$meta['uuid']] ??= [
+                        'uuid' => $meta['uuid'],
+                        'name' => $meta['name'],
+                        'domain' => $meta['rowDomain'],
+                        'link' => $meta['link'],
+                        'isService' => $meta['isService'],
+                        'requests' => 0,
+                        'bandwidth' => 0,
+                    ];
+                    $appRows[$meta['uuid']]['requests'] += $requests;
+                    $appRows[$meta['uuid']]['bandwidth'] += $bandwidth;
 
-                foreach ($client->paths($appKey, $from, $to, 50) as $path) {
-                    $data = $path->toArray();
-                    $pathStr = (string) ($data['path'] ?? '');
-                    // Prefer the per-path app from Sentinel; fall back to the active app filter
-                    // (older Sentinel omits `app`, but a filtered view still knows the app).
-                    $appId = (string) ($data['app'] ?? '');
-                    $resolveId = $appId !== '' ? $appId : ($appKey ?? '');
-                    // Key by (app, path) so the same path under two apps stays two rows, each
-                    // carrying its own domain.
-                    $key = $resolveId."\n".$pathStr;
-                    $domain = $resolveId !== '' ? ($this->appMeta($resolveId)['domain'] ?? null) : null;
-
-                    $pathTotals[$key] ??= ['path' => $pathStr, 'domain' => $domain, 'requests' => 0, 'bytesOut' => 0, 's4xx' => 0, 's5xx' => 0, 'p95' => 0.0];
-                    $pathTotals[$key]['requests'] += (int) ($data['requests'] ?? 0);
-                    $pathTotals[$key]['bytesOut'] += (int) ($data['bytesOut'] ?? 0);
-                    $pathTotals[$key]['s4xx'] += (int) ($data['s4xx'] ?? 0);
-                    $pathTotals[$key]['s5xx'] += (int) ($data['s5xx'] ?? 0);
-                    $pathTotals[$key]['p95'] = max($pathTotals[$key]['p95'], (float) ($data['p95'] ?? 0));
-                }
-
-                foreach ($this->breakdownDimensions as $dimension) {
-                    foreach ($client->breakdown($appKey, $dimension, $from, $to, 50) as $row) {
-                        $data = $row->toArray();
-                        $value = (string) ($data['value'] ?? '');
-
-                        $breakdownTotals[$dimension][$value] ??= ['value' => $value, 'requests' => 0, 'bytesOut' => 0];
-                        $breakdownTotals[$dimension][$value]['requests'] += (int) ($data['requests'] ?? 0);
-                        $breakdownTotals[$dimension][$value]['bytesOut'] += (int) ($data['bytesOut'] ?? 0);
-                    }
-                }
-
-                $attribution ??= $client->attribution();
-
-                // Per-bucket status series; summed by bucket across servers. Isolated so a
-                // series hiccup (or an older Sentinel lacking the endpoint) never discards a
-                // server's other data — an empty result simply flips the chart to the donut.
-                try {
-                    foreach ($client->series($appKey, $this->range) as $bucket) {
-                        $data = $bucket->toArray();
-                        $ts = (int) ($data['bucket'] ?? 0);
-
-                        $seriesByBucket[$ts] ??= ['bucket' => $ts, 's2xx' => 0, 's3xx' => 0, 's4xx' => 0, 's5xx' => 0, 'requests' => 0, 'bytesIn' => 0, 'bytesOut' => 0, 'uniqueVisitors' => 0, 'p95' => 0.0];
-                        $seriesByBucket[$ts]['s2xx'] += (int) ($data['s2xx'] ?? 0);
-                        $seriesByBucket[$ts]['s3xx'] += (int) ($data['s3xx'] ?? 0);
-                        $seriesByBucket[$ts]['s4xx'] += (int) ($data['s4xx'] ?? 0);
-                        $seriesByBucket[$ts]['s5xx'] += (int) ($data['s5xx'] ?? 0);
-                        $seriesByBucket[$ts]['requests'] += (int) ($data['requests'] ?? 0);
-                        $seriesByBucket[$ts]['bytesIn'] += (int) ($data['bytesIn'] ?? 0);
-                        $seriesByBucket[$ts]['bytesOut'] += (int) ($data['bytesOut'] ?? 0);
-                        // Uniques summed across servers (approximate); p95 takes the worst bucket.
-                        $seriesByBucket[$ts]['uniqueVisitors'] += (int) ($data['uniqueVisitors'] ?? 0);
-                        $seriesByBucket[$ts]['p95'] = max($seriesByBucket[$ts]['p95'], (float) ($data['p95'] ?? 0));
-                    }
-                } catch (\Throwable $e) {
-                    // Leave this server out of the series; donut fallback covers it.
+                    // Top hosts: fold per-key volume up to the served hostname. Keys without
+                    // a configured domain collapse into one "Unknown host" row.
+                    $host = $meta['domain'] ?? '';
+                    $hostTotals[$host] ??= ['host' => $host, 'requests' => 0, 'bandwidth' => 0];
+                    $hostTotals[$host]['requests'] += $requests;
+                    $hostTotals[$host]['bandwidth'] += $bandwidth;
                 }
             } catch (\Throwable $e) {
                 // Skip unreachable/failed servers so one bad server doesn't break the whole view.
@@ -399,7 +405,7 @@ class Analytics extends Component
             }
         }
 
-        if (empty($overviews)) {
+        if (! $aggregator->hasOverview()) {
             $this->resetData();
             // The chart lives under wire:ignore, so it only updates via this event — dispatch
             // even when cleared so a previously-populated chart flips to its no-data state
@@ -409,46 +415,17 @@ class Analytics extends Component
             return;
         }
 
-        $result = TrafficAnalyticsAggregator::sumOverviews($overviews);
+        $result = $aggregator->overview();
         $this->overview = $result['overview']->toArray();
         $this->latencyApproximate = $result['latencyApproximate'];
         $this->uniquesApproximate = $result['uniquesApproximate'];
 
-        usort($appRows, fn ($a, $b) => $b['requests'] <=> $a['requests']);
-        $this->topApps = array_slice($appRows, 0, 50);
-
-        // Top hosts: fold per-app volume up to the served hostname (an app's primary
-        // domain). Apps without a configured FQDN collapse into one "Unknown host" row.
-        $hostTotals = [];
-        foreach ($appRows as $row) {
-            $host = $row['domain'] ?? '';
-            $hostTotals[$host] ??= ['host' => $host, 'requests' => 0, 'bandwidth' => 0];
-            $hostTotals[$host]['requests'] += (int) $row['requests'];
-            $hostTotals[$host]['bandwidth'] += (int) $row['bandwidth'];
-        }
-        $hosts = array_values($hostTotals);
-        usort($hosts, fn ($a, $b) => $b['requests'] <=> $a['requests']);
-        $this->topHosts = array_slice($hosts, 0, 50);
-
-        $paths = array_values($pathTotals);
-        usort($paths, fn ($a, $b) => $b['requests'] <=> $a['requests']);
-        $this->topPaths = array_slice($paths, 0, 50);
-
-        $breakdowns = [];
-        foreach ($this->breakdownDimensions as $dimension) {
-            $rows = array_values($breakdownTotals[$dimension]);
-            usort($rows, fn ($a, $b) => $b['requests'] <=> $a['requests']);
-            if ($dimension === 'referer') {
-                $rows = groupRefererBreakdownRows($rows);
-            }
-            $breakdowns[$dimension] = array_slice($rows, 0, 50);
-        }
-        $this->breakdowns = $breakdowns;
-
-        $this->attribution = $attribution;
-
-        ksort($seriesByBucket);
-        $this->series = array_values($seriesByBucket);
+        $this->topApps = TrafficAnalyticsAggregator::topByRequests(array_values($appRows));
+        $this->topHosts = TrafficAnalyticsAggregator::topByRequests(array_values($hostTotals));
+        $this->topPaths = $aggregator->topPaths();
+        $this->breakdowns = $aggregator->breakdowns();
+        $this->attribution = $aggregator->attribution();
+        $this->series = $aggregator->series();
         $this->hasSeries = $this->series !== [];
 
         $this->dispatch("refreshChartData-{$this->chartId}-status", $this->chartPayload());
@@ -534,39 +511,47 @@ class Analytics extends Component
     }
 
     /**
-     * Resolve an app uuid to its display name, primary domain, and analytics-page link,
-     * memoized per request. Returns the uuid as the name for apps not owned by the team
-     * so a Sentinel-reported uuid never discloses another team's application name.
+     * Resolve a Sentinel key to its owning team resource: row id (resource uuid), name,
+     * key-specific domain (compose service / preview), primary domain for the leaderboard
+     * row, and analytics link. Memoized per request. A key that no team resource owns
+     * keeps the raw key as its name and no domain or link, so a Sentinel-reported key
+     * never discloses another team's resource.
      *
-     * @return array{name: string, domain: ?string, link: ?string}
+     * @return array{uuid: string, name: string, domain: ?string, rowDomain: ?string, link: ?string, isService: bool}
      */
-    protected function appMeta(string $uuid): array
+    protected function appMeta(string $key): array
     {
-        if (isset($this->appMetaCache[$uuid])) {
-            return $this->appMetaCache[$uuid];
+        if (isset($this->appMetaCache[$key])) {
+            return $this->appMetaCache[$key];
         }
 
-        $app = Application::ownedByCurrentTeam()->with('environment.project')->whereUuid($uuid)->first();
-
-        $domain = null;
-        if ($app) {
-            $first = collect($app->fqdns)->first();
-            $domain = $first ? (parse_url($first, PHP_URL_HOST) ?: null) : null;
+        $resources = $this->teamResources();
+        $owner = null;
+        foreach (SentinelTrafficClient::candidateOwnerUuids($key) as $candidate) {
+            if (isset($resources[$candidate])) {
+                $owner = $resources[$candidate];
+                break;
+            }
         }
 
-        $link = null;
-        if ($app && data_get($app, 'environment.project.uuid')) {
-            $link = route('project.application.analytics', [
-                'project_uuid' => $app->environment->project->uuid,
-                'environment_uuid' => $app->environment->uuid,
-                'application_uuid' => $app->uuid,
-            ]);
+        if ($owner === null) {
+            return $this->appMetaCache[$key] = [
+                'uuid' => $key,
+                'name' => $key,
+                'domain' => null,
+                'rowDomain' => null,
+                'link' => null,
+                'isService' => false,
+            ];
         }
 
-        return $this->appMetaCache[$uuid] = [
-            'name' => $app?->name ?? $uuid,
-            'domain' => $domain,
-            'link' => $link,
+        return $this->appMetaCache[$key] = [
+            'uuid' => $owner->uuid(),
+            'name' => $owner->name(),
+            'domain' => $owner->domainForKey($key),
+            'rowDomain' => $owner->primaryDomain(),
+            'link' => $owner->analyticsLink(),
+            'isService' => $owner->isService(),
         ];
     }
 
diff --git a/app/Livewire/Dashboard/TrafficAnalytics.php b/app/Livewire/Dashboard/TrafficAnalytics.php
index 532460d454..c24d7dac79 100644
--- a/app/Livewire/Dashboard/TrafficAnalytics.php
+++ b/app/Livewire/Dashboard/TrafficAnalytics.php
@@ -60,33 +60,18 @@ class TrafficAnalytics extends Component
 
         [$from, $to] = $this->window();
 
-        $overviews = [];
-        $seriesByBucket = [];
+        $aggregator = new TrafficAnalyticsAggregator;
 
         foreach ($this->servers as $server) {
             try {
                 $client = $this->trafficClient($server);
 
-                $overviews[] = $client->overview(null, $from, $to);
+                $aggregator->addOverview($client->overview(null, $from, $to));
 
                 // Per-bucket status series, summed across servers, for the sparklines.
                 // Isolated so a series hiccup (older Sentinel) never drops a server's overview.
                 try {
-                    foreach ($client->series(null, $this->range) as $bucket) {
-                        $data = $bucket->toArray();
-                        $ts = (int) ($data['bucket'] ?? 0);
-
-                        $seriesByBucket[$ts] ??= ['bucket' => $ts, 's2xx' => 0, 's3xx' => 0, 's4xx' => 0, 's5xx' => 0, 'requests' => 0, 'bytesIn' => 0, 'bytesOut' => 0, 'uniqueVisitors' => 0, 'p95' => 0.0];
-                        $seriesByBucket[$ts]['s2xx'] += (int) ($data['s2xx'] ?? 0);
-                        $seriesByBucket[$ts]['s3xx'] += (int) ($data['s3xx'] ?? 0);
-                        $seriesByBucket[$ts]['s4xx'] += (int) ($data['s4xx'] ?? 0);
-                        $seriesByBucket[$ts]['s5xx'] += (int) ($data['s5xx'] ?? 0);
-                        $seriesByBucket[$ts]['requests'] += (int) ($data['requests'] ?? 0);
-                        $seriesByBucket[$ts]['bytesIn'] += (int) ($data['bytesIn'] ?? 0);
-                        $seriesByBucket[$ts]['bytesOut'] += (int) ($data['bytesOut'] ?? 0);
-                        $seriesByBucket[$ts]['uniqueVisitors'] += (int) ($data['uniqueVisitors'] ?? 0);
-                        $seriesByBucket[$ts]['p95'] = max($seriesByBucket[$ts]['p95'], (float) ($data['p95'] ?? 0));
-                    }
+                    $aggregator->addSeries($client->series(null, $this->range));
                 } catch (\Throwable $e) {
                     // Leave this server out of the sparkline series.
                     \Log::debug('Traffic series fetch failed', ['server' => $server->uuid, 'error' => $e->getMessage()]);
@@ -99,7 +84,7 @@ class TrafficAnalytics extends Component
             }
         }
 
-        if (empty($overviews)) {
+        if (! $aggregator->hasOverview()) {
             // Every server's fetch failed; don't present an all-zero KPI panel as if it were real data.
             $this->overview = null;
             $this->latencyApproximate = false;
@@ -109,14 +94,13 @@ class TrafficAnalytics extends Component
             return;
         }
 
-        $result = TrafficAnalyticsAggregator::sumOverviews($overviews);
+        $result = $aggregator->overview();
 
         $this->overview = $result['overview']->toArray();
         $this->latencyApproximate = $result['latencyApproximate'];
         $this->uniquesApproximate = $result['uniquesApproximate'];
 
-        ksort($seriesByBucket);
-        $this->series = array_values($seriesByBucket);
+        $this->series = $aggregator->series();
 
         $this->dispatch("refreshChartData-{$this->chartId}-status", [
             'requestsSpark' => $this->requestsSpark(),
diff --git a/app/Livewire/Project/Application/Analytics.php b/app/Livewire/Project/Application/Analytics.php
index 52d15d9e10..b6f4578b5f 100644
--- a/app/Livewire/Project/Application/Analytics.php
+++ b/app/Livewire/Project/Application/Analytics.php
@@ -2,245 +2,19 @@
 
 namespace App\Livewire\Project\Application;
 
-use App\Livewire\Concerns\BuildsTrafficChartPayload;
+use App\Livewire\Project\Shared\ResourceTrafficAnalytics;
 use App\Models\Application;
-use App\Services\SentinelTrafficClient;
-use Illuminate\Contracts\View\View;
 use Livewire\Attributes\Lazy;
-use Livewire\Component;
 
 #[Lazy]
-class Analytics extends Component
+class Analytics extends ResourceTrafficAnalytics
 {
-    use BuildsTrafficChartPayload;
-
     public Application $application;
 
     public string $chartId = 'application-analytics';
 
-    public string $range = '24h';
-
-    public bool $enabled = false;
-
-    // Realtime refresh. Off by default (click "Live" to arm it). Only meaningful on the
-    // 24h range; the 60s cadence matches the SentinelTrafficClient cache TTL and
-    // Sentinel's per-minute rollups. The control is disabled for 7d/30d.
-    public bool $live = false;
-
-    public ?array $overview = null;
-
-    public array $topPaths = [];
-
-    /** @var array<string, array<int, array<string, mixed>>> */
-    public array $breakdowns = [];
-
-    public ?string $attribution = null;
-
-    /**
-     * Per-bucket status-class time series for the stacked area chart. Empty when this
-     * app's Sentinel lacks the series endpoint, which flips the chart to the donut.
-     *
-     * @var array<int, array{bucket: int, s2xx: int, s3xx: int, s4xx: int, s5xx: int}>
-     */
-    public array $series = [];
-
-    public bool $hasSeries = false;
-
-    /** @var array<int, string> */
-    protected array $breakdownDimensions = ['country', 'referer', 'browser', 'os', 'device', 'protocol', 'cache', 'status', 'agent', 'ip', 'useragent'];
-
-    public function mount(): void
+    protected function resourceProperty(): string
     {
-        $this->enabled = (bool) $this->application->destination?->server?->isTrafficAnalyticsEnabled();
-
-        if ($this->enabled) {
-            $this->loadData();
-        }
-    }
-
-    public function setRange(string $range): void
-    {
-        $this->range = in_array($range, ['24h', '7d', '30d'], true) ? $range : '24h';
-        $this->loadData();
-    }
-
-    public function toggleLive(): void
-    {
-        if ($this->range !== '24h') {
-            return;
-        }
-        $this->live = ! $this->live;
-    }
-
-    /**
-     * Realtime polling is only armed when the user has it on and the range is 24h.
-     */
-    public function isLivePollable(): bool
-    {
-        return $this->live && $this->range === '24h';
-    }
-
-    public function loadData(): void
-    {
-        if (! $this->enabled) {
-            return;
-        }
-
-        try {
-            [$from, $to] = $this->window();
-            $client = $this->trafficClient();
-            $key = $this->application->uuid;
-
-            // Warm every endpoint for this app in one docker exec instead of ~14 serial
-            // SSH round-trips; the per-call methods below then read from cache.
-            $client->prefetchServerWide($key, $from, $to, $this->breakdownDimensions, $this->range);
-
-            $this->overview = $client->overview($key, $from, $to)->toArray();
-
-            // Every path belongs to this one app, so decorate each row with its domain
-            // for a consistent "domain + path" presentation and an openable live link.
-            $domain = $this->applicationDomain();
-            $this->topPaths = $client->paths($key, $from, $to, 50)
-                ->map(fn ($path) => ['domain' => $domain] + $path->toArray())
-                ->all();
-
-            $breakdowns = [];
-            foreach ($this->breakdownDimensions as $dimension) {
-                $rows = $client->breakdown($key, $dimension, $from, $to, 50)
-                    ->map(fn ($row) => $row->toArray())
-                    ->all();
-                $breakdowns[$dimension] = $dimension === 'referer'
-                    ? groupRefererBreakdownRows($rows)
-                    : $rows;
-            }
-            $this->breakdowns = $breakdowns;
-
-            $this->attribution = $client->attribution();
-
-            // Per-bucket status series; absent on older Sentinel builds (empty → donut fallback).
-            // Isolated so a series hiccup never errors the rest of the widget.
-            try {
-                $this->series = $client->series($key, $this->range)
-                    ->map(fn ($bucket) => $bucket->toArray())
-                    ->all();
-            } catch (\Throwable $e) {
-                $this->series = [];
-            }
-            $this->hasSeries = $this->series !== [];
-
-            $this->dispatch("refreshChartData-{$this->chartId}-status", $this->chartPayload());
-        } catch (\Throwable $e) {
-            handleError($e, $this);
-        }
-    }
-
-    /**
-     * Payload for the status chart: the stacked-area time series when available,
-     * plus the donut totals as a fallback for older Sentinel builds.
-     *
-     * @return array<string, mixed>
-     */
-    protected function chartPayload(): array
-    {
-        $device = $this->deviceChartData();
-
-        return [
-            'hasSeries' => $this->hasSeries,
-            'range' => $this->range,
-            'seriesData' => [
-                $this->overview['s2xx'] ?? 0,
-                $this->overview['s3xx'] ?? 0,
-                $this->overview['s4xx'] ?? 0,
-                $this->overview['s5xx'] ?? 0,
-            ],
-            'timeSeries' => [
-                'categories' => array_column($this->series, 'bucket'),
-                'requests' => $this->requestsSpark(),
-                's2xx' => array_column($this->series, 's2xx'),
-                's3xx' => array_column($this->series, 's3xx'),
-                's4xx' => array_column($this->series, 's4xx'),
-                's5xx' => array_column($this->series, 's5xx'),
-            ],
-            'requestsSpark' => $this->requestsSpark(),
-            'sparkCategories' => array_column($this->series, 'bucket'),
-            'errorsSpark' => $this->errorsSpark(),
-            'bandwidthSpark' => $this->bandwidthSpark(),
-            'uniquesSpark' => $this->uniquesSpark(),
-            'latencySpark' => $this->latencySpark(),
-            'geo' => $this->geoMarkers(),
-            'deviceLabels' => $device['labels'],
-            'deviceSeries' => $device['series'],
-        ];
-    }
-
-    public function errorRate(): float
-    {
-        if (! $this->overview || (int) ($this->overview['requests'] ?? 0) === 0) {
-            return 0.0;
-        }
-
-        $errors = (int) ($this->overview['s4xx'] ?? 0) + (int) ($this->overview['s5xx'] ?? 0);
-
-        return round(($errors / $this->overview['requests']) * 100, 2);
-    }
-
-    public function bandwidthBytes(): int
-    {
-        if (! $this->overview) {
-            return 0;
-        }
-
-        return (int) ($this->overview['bytesIn'] ?? 0) + (int) ($this->overview['bytesOut'] ?? 0);
-    }
-
-    protected function trafficClient(): SentinelTrafficClient
-    {
-        return app(SentinelTrafficClient::class, ['server' => $this->application->destination->server]);
-    }
-
-    /**
-     * Primary domain host for this application (first configured FQDN), or null when
-     * none is set — used to present paths as "domain + path" with an openable link.
-     */
-    protected function applicationDomain(): ?string
-    {
-        $first = collect($this->application->fqdns)->first();
-
-        return $first ? (parse_url($first, PHP_URL_HOST) ?: null) : null;
-    }
-
-    /**
-     * @return array{0: string, 1: string}
-     */
-    private function window(): array
-    {
-        $to = now();
-        $from = match ($this->range) {
-            '7d' => now()->subDays(7),
-            '30d' => now()->subDays(30),
-            default => now()->subDay(),
-        };
-
-        return [$from->toIso8601ZuluString(), $to->toIso8601ZuluString()];
-    }
-
-    public function placeholder(array $params = []): View
-    {
-        $application = $params['application'] ?? null;
-
-        if ($application instanceof Application && ! $application->destination?->server?->isTrafficAnalyticsEnabled()) {
-            $this->application = $application;
-            $this->enabled = false;
-
-            return view('livewire.project.application.analytics');
-        }
-
-        // Rendered instantly; the Sentinel round-trip runs in the deferred lazy-load request.
-        return view('livewire.project.application.analytics-placeholder');
-    }
-
-    public function render()
-    {
-        return view('livewire.project.application.analytics');
+        return 'application';
     }
 }
diff --git a/app/Livewire/Project/Application/TrafficOverview.php b/app/Livewire/Project/Application/TrafficOverview.php
index 223c6047ae..86a6ff64f4 100644
--- a/app/Livewire/Project/Application/TrafficOverview.php
+++ b/app/Livewire/Project/Application/TrafficOverview.php
@@ -4,6 +4,7 @@ namespace App\Livewire\Project\Application;
 
 use App\Models\Application;
 use App\Services\SentinelTrafficClient;
+use App\Services\TrafficAnalyticsAggregator;
 use Livewire\Attributes\Lazy;
 use Livewire\Component;
 
@@ -36,7 +37,14 @@ class TrafficOverview extends Component
         if ($this->enabled && $server) {
             try {
                 $client = app(SentinelTrafficClient::class, ['server' => $server]);
-                $this->overview = $client->appOverview($this->application->uuid, '24h')->toArray();
+                // Compose services and previews record under their own keys; sum all of them.
+                $keys = $client->resourceKeys($this->application->uuid);
+                [$from, $to] = SentinelTrafficClient::rangeWindow('24h');
+                if (count($keys) > 1) {
+                    $client->prefetchAppOverviews($keys, $from, $to);
+                }
+                $overviews = array_map(fn (string $key) => $client->overview($key, $from, $to), $keys);
+                $this->overview = TrafficAnalyticsAggregator::sumOverviews($overviews)['overview']->toArray();
             } catch (\Throwable $e) {
                 $this->overview = null;
             }
diff --git a/app/Livewire/Project/Service/Analytics.php b/app/Livewire/Project/Service/Analytics.php
new file mode 100644
index 0000000000..9bdb130077
--- /dev/null
+++ b/app/Livewire/Project/Service/Analytics.php
@@ -0,0 +1,20 @@
+<?php
+
+namespace App\Livewire\Project\Service;
+
+use App\Livewire\Project\Shared\ResourceTrafficAnalytics;
+use App\Models\Service;
+use Livewire\Attributes\Lazy;
+
+#[Lazy]
+class Analytics extends ResourceTrafficAnalytics
+{
+    public Service $service;
+
+    public string $chartId = 'service-analytics';
+
+    protected function resourceProperty(): string
+    {
+        return 'service';
+    }
+}
diff --git a/app/Livewire/Project/Shared/ExecuteContainerCommand.php b/app/Livewire/Project/Shared/ExecuteContainerCommand.php
index e8202b8547..91064e6895 100644
--- a/app/Livewire/Project/Shared/ExecuteContainerCommand.php
+++ b/app/Livewire/Project/Shared/ExecuteContainerCommand.php
@@ -153,6 +153,9 @@ class ExecuteContainerCommand extends Component
         if ($this->containers->count() === 1) {
             $this->selected_container = $this->containerTarget($this->containers->first());
             $this->connectToContainer();
+        } elseif ($this->containers->count() > 1) {
+            // The terminal was rendered with auto-start before the containers were known.
+            $this->dispatch(Terminal::AUTO_START_CANCELLED_EVENT)->to(Terminal::class);
         }
 
         $this->containersLoaded = true;
@@ -190,7 +193,7 @@ class ExecuteContainerCommand extends Component
             // Dispatch a frontend event to ensure terminal gets focus after connection
             $this->dispatch('terminal-should-focus');
         } catch (\Throwable $e) {
-            return handleError($e, $this);
+            $this->failTerminalSession(Terminal::sessionFailureMessage($e));
         } finally {
             $this->isConnecting = false;
         }
@@ -200,7 +203,7 @@ class ExecuteContainerCommand extends Component
     public function connectToContainer()
     {
         if ($this->selected_container === 'default') {
-            $this->dispatch('error', 'Please select a container.');
+            $this->failTerminalSession('Please select a container.');
 
             return;
         }
@@ -251,12 +254,20 @@ class ExecuteContainerCommand extends Component
             // Dispatch a frontend event to ensure terminal gets focus after connection
             $this->dispatch('terminal-should-focus');
         } catch (\Throwable $e) {
-            return handleError($e, $this);
+            $this->failTerminalSession(Terminal::sessionFailureMessage($e));
         } finally {
             $this->isConnecting = false;
         }
     }
 
+    /**
+     * Stop the terminal "connecting…" state and show why. The terminal also shows the toast.
+     */
+    private function failTerminalSession(string $message): void
+    {
+        $this->dispatch(Terminal::SESSION_FAILED_EVENT, message: $message)->to(Terminal::class);
+    }
+
     public function render()
     {
         return view('livewire.project.shared.execute-container-command');
diff --git a/app/Livewire/Project/Shared/ResourceTrafficAnalytics.php b/app/Livewire/Project/Shared/ResourceTrafficAnalytics.php
new file mode 100644
index 0000000000..7ba0829855
--- /dev/null
+++ b/app/Livewire/Project/Shared/ResourceTrafficAnalytics.php
@@ -0,0 +1,236 @@
+<?php
+
+namespace App\Livewire\Project\Shared;
+
+use App\Livewire\Concerns\BuildsTrafficChartPayload;
+use App\Models\Application;
+use App\Models\Service;
+use App\Services\SentinelTrafficClient;
+use App\Services\TrafficAnalyticsAggregator;
+use App\Services\TrafficResource;
+use Illuminate\Contracts\View\View;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Livewire\Component;
+
+/**
+ * Traffic analytics tab of one resource (Application or Service). A resource can record
+ * under several Sentinel keys (compose services, previews); every key is fetched and
+ * merged into one view.
+ */
+abstract class ResourceTrafficAnalytics extends Component
+{
+    use AuthorizesRequests;
+    use BuildsTrafficChartPayload;
+
+    public string $chartId = 'resource-analytics';
+
+    public string $range = '24h';
+
+    public bool $enabled = false;
+
+    public ?string $analyticsServerUuid = null;
+
+    // Realtime refresh. Off by default (click "Live" to arm it). Only meaningful on the
+    // 24h range; the 60s cadence matches the SentinelTrafficClient cache TTL and
+    // Sentinel's per-minute rollups. The control is disabled for 7d/30d.
+    public bool $live = false;
+
+    public ?array $overview = null;
+
+    public bool $latencyApproximate = false;
+
+    public bool $uniquesApproximate = false;
+
+    public array $topPaths = [];
+
+    /** @var array<string, array<int, array<string, mixed>>> */
+    public array $breakdowns = [];
+
+    public ?string $attribution = null;
+
+    /**
+     * Per-bucket status-class time series for the stacked area chart. Empty when this
+     * resource's Sentinel lacks the series endpoint, which flips the chart to the donut.
+     *
+     * @var array<int, array{bucket: int, s2xx: int, s3xx: int, s4xx: int, s5xx: int}>
+     */
+    public array $series = [];
+
+    public bool $hasSeries = false;
+
+    /** @var array<int, string> */
+    protected array $breakdownDimensions = ['country', 'referer', 'browser', 'os', 'device', 'protocol', 'cache', 'status', 'agent', 'ip', 'useragent'];
+
+    /**
+     * Name of the public model property and lazy-load parameter ('application' / 'service').
+     */
+    abstract protected function resourceProperty(): string;
+
+    protected function resourceModel(): Application|Service
+    {
+        return $this->{$this->resourceProperty()};
+    }
+
+    protected function trafficResource(): TrafficResource
+    {
+        return TrafficResource::for($this->resourceModel());
+    }
+
+    public function mount(): void
+    {
+        $this->authorize('view', $this->resourceModel());
+
+        $server = $this->trafficResource()->server();
+        $this->analyticsServerUuid = $server?->uuid;
+        $this->enabled = (bool) $server?->isTrafficAnalyticsEnabled();
+
+        if ($this->enabled) {
+            $this->loadData();
+        }
+    }
+
+    public function setRange(string $range): void
+    {
+        $this->range = in_array($range, ['24h', '7d', '30d'], true) ? $range : '24h';
+        $this->loadData();
+    }
+
+    public function toggleLive(): void
+    {
+        if ($this->range !== '24h') {
+            return;
+        }
+        $this->live = ! $this->live;
+    }
+
+    /**
+     * Realtime polling is only armed when the user has it on and the range is 24h.
+     */
+    public function isLivePollable(): bool
+    {
+        return $this->live && $this->range === '24h';
+    }
+
+    public function loadData(): void
+    {
+        if (! $this->enabled) {
+            return;
+        }
+
+        try {
+            $this->authorize('view', $this->resourceModel());
+
+            $resource = $this->trafficResource();
+            [$from, $to] = SentinelTrafficClient::rangeWindow($this->range);
+            $client = app(SentinelTrafficClient::class, ['server' => $resource->server()]);
+
+            // Resolve every key of this resource and warm all of them in one or two
+            // docker execs; the per-call methods below then read from cache.
+            $keys = $client->prefetchResource($resource->uuid(), $from, $to, $this->breakdownDimensions, $this->range);
+
+            $aggregator = new TrafficAnalyticsAggregator($this->breakdownDimensions);
+            foreach ($keys as $key) {
+                $aggregator->collect($client, $key, $from, $to, $this->range, fn (string $appKey) => $resource->domainForKey($appKey));
+            }
+
+            $result = $aggregator->overview();
+            $this->overview = $result['overview']->toArray();
+            $this->latencyApproximate = $result['latencyApproximate'];
+            $this->uniquesApproximate = $result['uniquesApproximate'];
+            $this->topPaths = $aggregator->topPaths();
+            $this->breakdowns = $aggregator->breakdowns();
+            $this->attribution = $aggregator->attribution();
+            $this->series = $aggregator->series();
+            $this->hasSeries = $this->series !== [];
+
+            $this->dispatch("refreshChartData-{$this->chartId}-status", $this->chartPayload());
+        } catch (\Throwable $e) {
+            handleError($e, $this);
+        }
+    }
+
+    /**
+     * Payload for the status chart: the stacked-area time series when available,
+     * plus the donut totals as a fallback for older Sentinel builds.
+     *
+     * @return array<string, mixed>
+     */
+    protected function chartPayload(): array
+    {
+        $device = $this->deviceChartData();
+
+        return [
+            'hasSeries' => $this->hasSeries,
+            'range' => $this->range,
+            'seriesData' => [
+                $this->overview['s2xx'] ?? 0,
+                $this->overview['s3xx'] ?? 0,
+                $this->overview['s4xx'] ?? 0,
+                $this->overview['s5xx'] ?? 0,
+            ],
+            'timeSeries' => [
+                'categories' => array_column($this->series, 'bucket'),
+                'requests' => $this->requestsSpark(),
+                's2xx' => array_column($this->series, 's2xx'),
+                's3xx' => array_column($this->series, 's3xx'),
+                's4xx' => array_column($this->series, 's4xx'),
+                's5xx' => array_column($this->series, 's5xx'),
+            ],
+            'requestsSpark' => $this->requestsSpark(),
+            'sparkCategories' => array_column($this->series, 'bucket'),
+            'errorsSpark' => $this->errorsSpark(),
+            'bandwidthSpark' => $this->bandwidthSpark(),
+            'uniquesSpark' => $this->uniquesSpark(),
+            'latencySpark' => $this->latencySpark(),
+            'geo' => $this->geoMarkers(),
+            'deviceLabels' => $device['labels'],
+            'deviceSeries' => $device['series'],
+        ];
+    }
+
+    public function errorRate(): float
+    {
+        if (! $this->overview || (int) ($this->overview['requests'] ?? 0) === 0) {
+            return 0.0;
+        }
+
+        $errors = (int) ($this->overview['s4xx'] ?? 0) + (int) ($this->overview['s5xx'] ?? 0);
+
+        return round(($errors / $this->overview['requests']) * 100, 2);
+    }
+
+    public function bandwidthBytes(): int
+    {
+        if (! $this->overview) {
+            return 0;
+        }
+
+        return (int) ($this->overview['bytesIn'] ?? 0) + (int) ($this->overview['bytesOut'] ?? 0);
+    }
+
+    public function placeholder(array $params = []): View
+    {
+        $model = $params[$this->resourceProperty()] ?? null;
+
+        if ($model instanceof Application || $model instanceof Service) {
+            $this->authorize('view', $model);
+            $server = TrafficResource::for($model)->server();
+
+            if (! $server?->isTrafficAnalyticsEnabled()) {
+                $this->{$this->resourceProperty()} = $model;
+                $this->enabled = false;
+                $this->analyticsServerUuid = $server?->uuid;
+
+                return view('livewire.project.application.analytics');
+            }
+        }
+
+        // Rendered instantly; the Sentinel round-trip runs in the deferred lazy-load request.
+        return view('livewire.project.application.analytics-placeholder');
+    }
+
+    public function render()
+    {
+        return view('livewire.project.application.analytics');
+    }
+}
diff --git a/app/Livewire/Project/Shared/Terminal.php b/app/Livewire/Project/Shared/Terminal.php
index de4e00cf20..01a89b721a 100644
--- a/app/Livewire/Project/Shared/Terminal.php
+++ b/app/Livewire/Project/Shared/Terminal.php
@@ -5,14 +5,27 @@ namespace App\Livewire\Project\Shared;
 use App\Models\Server;
 use App\Services\TerminalSessionService;
 use App\Support\ValidationPatterns;
+use Illuminate\Auth\Access\AuthorizationException;
+use Illuminate\Database\Eloquent\ModelNotFoundException;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Attributes\On;
 use Livewire\Component;
+use Symfony\Component\HttpKernel\Exception\HttpExceptionInterface;
+use Throwable;
 
 class Terminal extends Component
 {
     use AuthorizesRequests;
 
+    /** Browser event: no terminal token was issued. Payload: `message`. */
+    public const SESSION_FAILED_EVENT = 'terminal-session-failed';
+
+    /** Browser event: the page did not auto-select a target, so stop the auto-start wait. */
+    public const AUTO_START_CANCELLED_EVENT = 'terminal-auto-start-cancelled';
+
+    /** Same text for denied and unknown targets, so other teams' resources stay hidden. */
+    public const NOT_ALLOWED_MESSAGE = 'You are not allowed to open a terminal for this resource.';
+
     public bool $hasShell = true;
 
     public bool $isTerminalConnected = false;
@@ -31,38 +44,52 @@ class Terminal extends Component
             ], $server);
 
             return true;
-        } catch (\Throwable) {
+        } catch (Throwable) {
             return false;
         }
     }
 
     #[On('send-terminal-command')]
-    public function sendTerminalCommand($isContainer, $identifier, $serverUuid, TerminalSessionService $terminalSessionService)
+    public function sendTerminalCommand($isContainer, $identifier, $serverUuid, TerminalSessionService $terminalSessionService): void
     {
-        $this->authorize('canAccessTerminal');
+        try {
+            $this->authorize('canAccessTerminal');
 
-        $server = Server::ownedByCurrentTeam()->whereUuid($serverUuid)->firstOrFail();
-        $this->authorize('view', $server);
+            $server = Server::ownedByCurrentTeam()->whereUuid($serverUuid)->firstOrFail();
+            $this->authorize('view', $server);
+        } catch (AuthorizationException|ModelNotFoundException) {
+            $this->failTerminalSession(self::NOT_ALLOWED_MESSAGE);
+
+            return;
+        }
 
         if (! $server->isTerminalEnabled() || $server->isForceDisabled()) {
-            abort(403, 'Terminal access is disabled on this server.');
+            $this->failTerminalSession('Terminal access is disabled on this server.');
+
+            return;
         }
 
         if ($isContainer) {
             // Validate container identifier format (alphanumeric, dashes, and underscores only)
-            if (! ValidationPatterns::isValidContainerName($identifier)) {
-                throw new \InvalidArgumentException('Invalid container identifier format');
+            if (! is_string($identifier) || ! ValidationPatterns::isValidContainerName($identifier)) {
+                $this->failTerminalSession('The container name is not valid.');
+
+                return;
             }
 
             // Verify container exists and belongs to the user's team
             $status = getContainerStatus($server, $identifier);
             if ($status !== 'running') {
+                $this->failTerminalSession('The container is not running.');
+
                 return;
             }
 
             // Check shell availability
             $this->hasShell = $this->checkShellAvailability($server, $identifier);
             if (! $this->hasShell) {
+                $this->failTerminalSession('No shell is available in this container.');
+
                 return;
             }
         }
@@ -71,6 +98,28 @@ class Terminal extends Component
         $this->dispatch('send-terminal-token', $token);
     }
 
+    /**
+     * Message for an exception on the terminal start path. Denied and missing
+     * resources get the same text, so the message does not reveal other teams' data.
+     */
+    public static function sessionFailureMessage(Throwable $exception): string
+    {
+        $isDenied = $exception instanceof AuthorizationException
+            || $exception instanceof ModelNotFoundException
+            || ($exception instanceof HttpExceptionInterface && in_array($exception->getStatusCode(), [403, 404], true));
+
+        if ($isDenied) {
+            return self::NOT_ALLOWED_MESSAGE;
+        }
+
+        return $exception->getMessage() ?: 'Could not start the terminal session.';
+    }
+
+    private function failTerminalSession(string $message): void
+    {
+        $this->dispatch(self::SESSION_FAILED_EVENT, message: $message)->self();
+    }
+
     #[On('terminalConnected')]
     public function markTerminalConnected(): void
     {
diff --git a/app/Livewire/Server/Navbar.php b/app/Livewire/Server/Navbar.php
index b64adf10a3..545494db51 100644
--- a/app/Livewire/Server/Navbar.php
+++ b/app/Livewire/Server/Navbar.php
@@ -258,6 +258,7 @@ class Navbar extends Component
             'proxy-configuration-state-changed',
             pending: $this->server->hasPendingProxyConfiguration(),
             traefikOutdated: $this->server->hasCurrentTraefikOutdatedInfo(),
+            proxyNotRunning: $this->server->proxySet() && ($this->server->proxy->status ?? 'unknown') !== 'running',
         );
     }
 
diff --git a/app/Livewire/Server/Proxy.php b/app/Livewire/Server/Proxy.php
index 5c3624a2b6..af30b3a02b 100644
--- a/app/Livewire/Server/Proxy.php
+++ b/app/Livewire/Server/Proxy.php
@@ -201,7 +201,6 @@ class Proxy extends Component
         }
     }
 
-<<<<<<< Updated upstream
     public function getTraefikVersionForWarningProperty(): ?string
     {
         if ($this->server->detected_traefik_version) {
@@ -218,7 +217,8 @@ class Proxy extends Component
         }
 
         return $matches[1];
-=======
+    }
+
     public function loadTraefikCertificates(): void
     {
         $this->traefikCertificates = [];
@@ -243,7 +243,6 @@ class Proxy extends Component
         } catch (\Throwable $e) {
             handleError($e, $this);
         }
->>>>>>> Stashed changes
     }
 
     /**
diff --git a/app/Livewire/Server/TrafficAnalyticsSettings.php b/app/Livewire/Server/TrafficAnalyticsSettings.php
index b0d80f00c0..221e724a2a 100644
--- a/app/Livewire/Server/TrafficAnalyticsSettings.php
+++ b/app/Livewire/Server/TrafficAnalyticsSettings.php
@@ -3,6 +3,7 @@
 namespace App\Livewire\Server;
 
 use App\Actions\Server\ConfigureTrafficAnalytics;
+use App\Enums\ProxyTypes;
 use App\Livewire\Analytics;
 use App\Models\Server;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
@@ -74,20 +75,18 @@ class TrafficAnalyticsSettings extends Component
     {
         try {
             $this->authorize('update', $this->server);
-            if ($this->server->isSwarm() || $this->server->isBuildServer()) {
-                $this->dispatch('error', 'Traffic analytics is not supported on Swarm/Build servers.');
+            $enable = ! $this->server->isTrafficAnalyticsEnabled();
+            if ($enable && ($reason = $this->server->trafficAnalyticsUnsupportedReason()) !== null) {
+                $this->dispatch('error', $reason);
 
                 return;
             }
 
-            $enable = ! $this->server->isTrafficAnalyticsEnabled();
-            ConfigureTrafficAnalytics::run($this->server, $enable);
+            $proxyRestarted = ConfigureTrafficAnalytics::run($this->server, $enable);
             $this->server->refresh();
             $this->isTrafficAnalyticsEnabled = $this->server->isTrafficAnalyticsEnabled();
             $this->dispatch('trafficAnalyticsStateChanged')->to(Analytics::class);
-            $this->dispatch('success', $enable
-                ? 'Traffic analytics enabled. Restarting proxy and Sentinel.'
-                : 'Traffic analytics disabled. Restarting proxy and Sentinel.');
+            $this->dispatch('success', $this->toggleMessage($enable, $proxyRestarted));
             auditLog($enable ? 'ui.server.traffic_analytics.enabled' : 'ui.server.traffic_analytics.disabled', $this->auditContext());
         } catch (\Throwable $e) {
             handleError($e, $this);
@@ -110,7 +109,43 @@ class TrafficAnalyticsSettings extends Component
 
     public function render(): View
     {
-        return view('livewire.server.traffic-analytics-settings');
+        return view('livewire.server.traffic-analytics-settings', [
+            'unsupportedReason' => $this->server->trafficAnalyticsUnsupportedReason(),
+            'caddyRedeployNote' => $this->caddyRedeployNote(),
+        ]);
+    }
+
+    /**
+     * Caddy gets its log labels at deploy time, so resources that already run are not logged until a redeploy.
+     */
+    private function caddyRedeployNote(): ?string
+    {
+        return $this->server->proxyType() === ProxyTypes::CADDY->value
+            ? 'Caddy logs a resource only after you redeploy it.'
+            : null;
+    }
+
+    private function toggleMessage(bool $enabled, bool $proxyRestarted): string
+    {
+        $message = $this->proxyToggleMessage($enabled, $proxyRestarted);
+        $caddyRedeployNote = $this->caddyRedeployNote();
+
+        return $enabled && $caddyRedeployNote !== null ? "{$message} {$caddyRedeployNote}" : $message;
+    }
+
+    private function proxyToggleMessage(bool $enabled, bool $proxyRestarted): string
+    {
+        $state = $enabled ? 'enabled' : 'disabled';
+
+        if ($proxyRestarted) {
+            return "Traffic analytics {$state}. Restarting proxy and Sentinel.";
+        }
+
+        if ($this->server->hasTrafficAnalyticsProxy()) {
+            return "Traffic analytics {$state}. The proxy is stopped, so the new configuration applies the next time you start it.";
+        }
+
+        return "Traffic analytics {$state}.";
     }
 
     private function auditContext(array $context = []): array
diff --git a/app/Livewire/Source/Github/Change.php b/app/Livewire/Source/Github/Change.php
index 6bb896fcc6..6c65190e80 100644
--- a/app/Livewire/Source/Github/Change.php
+++ b/app/Livewire/Source/Github/Change.php
@@ -89,8 +89,8 @@ class Change extends Component
         return [
             'name' => 'required|string',
             'organization' => ['nullable', 'string', 'regex:/\A[^\s\/?#]+\z/'],
-            'apiUrl' => ['required', 'string', 'url', new SafeExternalUrl],
-            'htmlUrl' => ['required', 'string', 'url', new SafeExternalUrl],
+            'apiUrl' => ['required', 'string', 'url', SafeExternalUrl::forGitSource()],
+            'htmlUrl' => ['required', 'string', 'url', SafeExternalUrl::forGitSource()],
             'customUser' => 'required|string',
             'customPort' => 'required|int',
             'appId' => 'nullable|int',
diff --git a/app/Livewire/Source/Github/Create.php b/app/Livewire/Source/Github/Create.php
index 6a5bf6e607..37eea732c3 100644
--- a/app/Livewire/Source/Github/Create.php
+++ b/app/Livewire/Source/Github/Create.php
@@ -59,8 +59,8 @@ class Create extends Component
             $this->validate([
                 'name' => 'required|string',
                 'organization' => ['nullable', 'string', 'regex:/\A[^\s\/?#]+\z/'],
-                'api_url' => ['required', 'string', 'url', new SafeExternalUrl],
-                'html_url' => ['required', 'string', 'url', new SafeExternalUrl],
+                'api_url' => ['required', 'string', 'url', SafeExternalUrl::forGitSource()],
+                'html_url' => ['required', 'string', 'url', SafeExternalUrl::forGitSource()],
                 'custom_user' => 'required|string',
                 'custom_port' => 'required|int',
                 'is_system_wide' => 'required|bool',
diff --git a/app/Livewire/Source/Gitlab/Change.php b/app/Livewire/Source/Gitlab/Change.php
index 29374105b2..50c9e9115c 100644
--- a/app/Livewire/Source/Gitlab/Change.php
+++ b/app/Livewire/Source/Gitlab/Change.php
@@ -70,8 +70,8 @@ class Change extends Component
     {
         return [
             'name' => 'required|string',
-            'apiUrl' => ['required', 'string', 'url', new SafeExternalUrl],
-            'htmlUrl' => ['required', 'string', 'url', new SafeExternalUrl],
+            'apiUrl' => ['required', 'string', 'url', SafeExternalUrl::forGitSource()],
+            'htmlUrl' => ['required', 'string', 'url', SafeExternalUrl::forGitSource()],
             'customUser' => 'required|string',
             'customPort' => 'required|int',
             'clientId' => 'nullable|string',
diff --git a/app/Livewire/Source/Gitlab/Create.php b/app/Livewire/Source/Gitlab/Create.php
index 200bd6d403..2846d20b1b 100644
--- a/app/Livewire/Source/Gitlab/Create.php
+++ b/app/Livewire/Source/Gitlab/Create.php
@@ -59,8 +59,8 @@ class Create extends Component
 
             $this->validate([
                 'name' => 'required|string',
-                'html_url' => ['required', 'string', 'url', new SafeExternalUrl],
-                'api_url' => ['required', 'string', 'url', new SafeExternalUrl],
+                'html_url' => ['required', 'string', 'url', SafeExternalUrl::forGitSource()],
+                'api_url' => ['required', 'string', 'url', SafeExternalUrl::forGitSource()],
                 'custom_user' => 'required|string',
                 'custom_port' => 'required|int',
                 'is_system_wide' => 'required|bool',
diff --git a/app/Models/Server.php b/app/Models/Server.php
index d4afa8a8a6..aa813600d7 100644
--- a/app/Models/Server.php
+++ b/app/Models/Server.php
@@ -1061,6 +1061,35 @@ $siteAddress {
         return (bool) data_get($this, 'settings.is_traffic_analytics_enabled', false);
     }
 
+    /**
+     * Traffic analytics reads the access log of a Coolify-managed Traefik or Caddy proxy.
+     */
+    public function hasTrafficAnalyticsProxy(): bool
+    {
+        return in_array($this->proxyType(), [ProxyTypes::TRAEFIK->value, ProxyTypes::CADDY->value], true);
+    }
+
+    /**
+     * Why traffic analytics cannot be enabled on this server, or null when it can.
+     */
+    public function trafficAnalyticsUnsupportedReason(): ?string
+    {
+        if ($this->isSwarm() || $this->isBuildServer()) {
+            return 'Traffic analytics is not supported on Swarm/Build servers.';
+        }
+
+        if (! $this->hasTrafficAnalyticsProxy()) {
+            return 'Traffic analytics needs the Traefik or Caddy proxy.';
+        }
+
+        return null;
+    }
+
+    public function supportsTrafficAnalytics(): bool
+    {
+        return $this->trafficAnalyticsUnsupportedReason() === null;
+    }
+
     /**
      * Caddy's `log_append` tags access-log lines with the app UUID for traffic analytics. It needs
      * Caddy 2.8+, which caddy-docker-proxy ships from 2.9: the 2.8 image (the default before 2.13)
@@ -1916,6 +1945,7 @@ $siteAddress {
             return str($proxyType->value)->lower();
         });
         if ($validProxyTypes->contains(str($proxyType)->lower())) {
+            $previousProxyType = $this->proxyType();
             $this->proxy->set('type', str($proxyType)->upper());
             $this->proxy->set('status', 'exited');
             $this->proxy->set('last_saved_proxy_configuration', null);
@@ -1931,11 +1961,26 @@ $siteAddress {
                     StartProxy::run($this);
                 }
             }
+            if ($previousProxyType !== $this->proxyType() && $this->shouldRestartSentinelForTrafficAnalytics()) {
+                // Sentinel keeps the traffic log mount, path and log format of the old proxy until it is recreated.
+                $this->restartSentinel();
+            }
         } else {
             throw new \Exception('Invalid proxy type.');
         }
     }
 
+    /**
+     * Sentinel reads the proxy access log only when it runs and traffic analytics is on.
+     * The raw setting is used, because a switch to a proxy without analytics support must also drop the old log mount.
+     */
+    private function shouldRestartSentinelForTrafficAnalytics(): bool
+    {
+        return (bool) $this->settings->is_sentinel_enabled
+            && $this->isSentinelEnabled()
+            && $this->isTrafficAnalyticsEnabled();
+    }
+
     public function isEmpty()
     {
         return $this->applications()->count() == 0 &&
diff --git a/app/Models/ServerSetting.php b/app/Models/ServerSetting.php
index 624458ef91..32afb2a2a7 100644
--- a/app/Models/ServerSetting.php
+++ b/app/Models/ServerSetting.php
@@ -135,6 +135,16 @@ class ServerSetting extends Model
         'compose_version_checked_at',
     ];
 
+    /**
+     * Model-level defaults that mirror database column defaults, so a freshly
+     * created instance exposes them without a refresh.
+     *
+     * @var array<string, mixed>
+     */
+    protected $attributes = [
+        'is_traffic_analytics_enabled' => false,
+    ];
+
     protected $casts = [
         'force_disabled' => 'boolean',
         'force_docker_cleanup' => 'boolean',
diff --git a/app/Providers/AppServiceProvider.php b/app/Providers/AppServiceProvider.php
index fbdaaecab0..27f095ac45 100644
--- a/app/Providers/AppServiceProvider.php
+++ b/app/Providers/AppServiceProvider.php
@@ -100,7 +100,10 @@ class AppServiceProvider extends ServiceProvider
     private function configureGitHubHttp(): void
     {
         Http::macro('GitSource', function (string $url) {
-            return Http::withOptions(SafeExternalUrl::httpClientOptions($url));
+            return Http::withOptions(SafeExternalUrl::httpClientOptions(
+                $url,
+                allowPrivateNetworks: SafeExternalUrl::gitSourcesMayUsePrivateNetworks(),
+            ));
         });
 
         Http::macro('GitHub', function (string $api_url, ?string $github_access_token = null) {
diff --git a/app/Rules/SafeWebhookUrl.php b/app/Rules/SafeWebhookUrl.php
index 5add4c1896..7d614d03de 100644
--- a/app/Rules/SafeWebhookUrl.php
+++ b/app/Rules/SafeWebhookUrl.php
@@ -14,11 +14,29 @@ class SafeWebhookUrl implements ValidationRule
 {
     /**
      * @param  (Closure(string): array<int, string>)|null  $resolver
-     */
-    /**
      * @param  array<int, string>  $trustedInternalHosts
+     * @param  bool  $allowPrivateNetworks  Allow private, CGNAT, and unique local addresses and internal hostnames.
+     *                                      Loopback, link-local (cloud metadata), and reserved targets stay blocked.
      */
-    public function __construct(private ?Closure $resolver = null, private array $trustedInternalHosts = []) {}
+    public function __construct(
+        private ?Closure $resolver = null,
+        private array $trustedInternalHosts = [],
+        private bool $allowPrivateNetworks = false,
+    ) {}
+
+    /**
+     * Git sources such as GitHub Enterprise or GitLab often run on a private network.
+     * Self-hosted instances allow them. Coolify Cloud keeps them blocked.
+     */
+    public static function forGitSource(): static
+    {
+        return new static(allowPrivateNetworks: self::gitSourcesMayUsePrivateNetworks());
+    }
+
+    public static function gitSourcesMayUsePrivateNetworks(): bool
+    {
+        return ! isCloud();
+    }
 
     /**
      * Run the validation rule.
@@ -112,7 +130,7 @@ class SafeWebhookUrl implements ValidationRule
      * @param  (Closure(string): array<int, string>)|null  $resolver
      * @return array<string, mixed>
      */
-    public static function httpClientOptions(string $url, array $trustedInternalHosts = [], ?Closure $resolver = null): array
+    public static function httpClientOptions(string $url, array $trustedInternalHosts = [], ?Closure $resolver = null, bool $allowPrivateNetworks = false): array
     {
         $options = ['allow_redirects' => false];
 
@@ -120,7 +138,7 @@ class SafeWebhookUrl implements ValidationRule
             throw new \RuntimeException('Webhook URL DNS pinning is unavailable.');
         }
 
-        $target = self::resolveUrlForRequest($url, $trustedInternalHosts, $resolver);
+        $target = self::resolveUrlForRequest($url, $trustedInternalHosts, $resolver, $allowPrivateNetworks);
 
         if ($target['ips'] === [] || filter_var($target['host'], FILTER_VALIDATE_IP)) {
             return $options;
@@ -187,9 +205,9 @@ class SafeWebhookUrl implements ValidationRule
     /**
      * @return array{host: string, port: int, ips: array<int, string>}
      */
-    private static function resolveUrlForRequest(string $url, array $trustedInternalHosts = [], ?Closure $resolver = null): array
+    private static function resolveUrlForRequest(string $url, array $trustedInternalHosts = [], ?Closure $resolver = null, bool $allowPrivateNetworks = false): array
     {
-        $rule = new self(resolver: $resolver, trustedInternalHosts: $trustedInternalHosts);
+        $rule = new self(resolver: $resolver, trustedInternalHosts: $trustedInternalHosts, allowPrivateNetworks: $allowPrivateNetworks);
         if (! filter_var($url, FILTER_VALIDATE_URL)) {
             throw new \RuntimeException('Webhook URL is invalid.');
         }
@@ -372,7 +390,11 @@ class SafeWebhookUrl implements ValidationRule
         }
 
         if ($this->isPrivateIp($ip)) {
-            return $this->isAllowedHostname($host) || $this->isAllowlistedIp($ip);
+            return $this->allowPrivateNetworks || $this->isAllowedHostname($host) || $this->isAllowlistedIp($ip);
+        }
+
+        if ($this->allowPrivateNetworks && $this->ipv4InCidr($ip, '100.64.0.0/10')) {
+            return true;
         }
 
         return $this->isAllowlistedIp($ip);
@@ -491,8 +513,16 @@ class SafeWebhookUrl implements ValidationRule
 
     private function isBlockedHostname(string $host): bool
     {
-        return in_array($host, ['localhost'], true)
-            || str_ends_with($host, '.local')
+        if ($host === 'localhost') {
+            return true;
+        }
+
+        // The resolved addresses of internal hostnames are still checked.
+        if ($this->allowPrivateNetworks) {
+            return false;
+        }
+
+        return str_ends_with($host, '.local')
             || str_ends_with($host, '.internal')
             || str_ends_with($host, '.cluster.local');
     }
diff --git a/app/Services/SentinelTrafficClient.php b/app/Services/SentinelTrafficClient.php
index 3cd7eabe6c..74e70367dd 100644
--- a/app/Services/SentinelTrafficClient.php
+++ b/app/Services/SentinelTrafficClient.php
@@ -50,17 +50,6 @@ class SentinelTrafficClient
         return [$from->toIso8601ZuluString(), $to->toIso8601ZuluString()];
     }
 
-    /**
-     * Slim shared fetch for a single application's overview over a UI range, so the
-     * General-page widget and the full analytics tab don't duplicate window + client calls.
-     */
-    public function appOverview(string $appKey, string $range = '24h'): TrafficOverviewData
-    {
-        [$from, $to] = self::rangeWindow($range);
-
-        return $this->overview($appKey, $from, $to);
-    }
-
     public function paths(?string $appKey, string $from, string $to, int $limit = 50): Collection
     {
         $rows = json_decode($this->raw($this->pathsUrl($appKey, $from, $to, $limit)), true) ?? [];
@@ -102,6 +91,137 @@ class SentinelTrafficClient
         return json_decode($this->raw($this->appsUrl()), true) ?? [];
     }
 
+    /**
+     * True when Sentinel key $key belongs to the resource with $resourceUuid. A resource
+     * (Application or Service) owns the bare `{uuid}` key and every `{uuid}-…` key: compose
+     * services (`{uuid}-{service}`), previews (`{uuid}-{pr}`), and preview compose services.
+     */
+    public static function keyBelongsTo(string $key, string $resourceUuid): bool
+    {
+        return $resourceUuid !== '' && ($key === $resourceUuid || str_starts_with($key, $resourceUuid.'-'));
+    }
+
+    /**
+     * Uuids that could own $key, most specific first: the key itself, then every prefix
+     * that ends before a `-`. Lets a caller match a key against a uuid map in O(key length).
+     *
+     * @return array<int, string>
+     */
+    public static function candidateOwnerUuids(string $key): array
+    {
+        $candidates = [$key];
+        $position = strlen($key);
+        while (($position = strrpos(substr($key, 0, $position), '-')) !== false) {
+            if ($position > 0) {
+                $candidates[] = substr($key, 0, $position);
+            }
+        }
+
+        return $candidates;
+    }
+
+    /**
+     * Every Sentinel key recorded on this server that belongs to the resource. Falls back to
+     * the bare uuid when none is recorded (or the key list is unavailable), so per-key queries
+     * still run and return an empty result instead of failing.
+     *
+     * @return array<int, string>
+     */
+    public function resourceKeys(string $resourceUuid): array
+    {
+        $this->assertSafeKey($resourceUuid);
+
+        try {
+            $recorded = $this->apps();
+        } catch (\Throwable) {
+            $recorded = [];
+        }
+
+        $keys = array_values(array_unique(array_filter(
+            $recorded,
+            fn ($key) => is_string($key)
+                && $this->isSafeKey($key)
+                && self::keyBelongsTo($key, $resourceUuid)
+        )));
+        sort($keys);
+
+        return $keys === [] ? [$resourceUuid] : $keys;
+    }
+
+    /**
+     * Resolve the resource's keys and warm every endpoint for each key, in as few SSH
+     * round-trips as possible: the key list and the bare-uuid dashboard bundle (the common
+     * single-key case) share one exec, and extra keys share one more.
+     *
+     * @param  array<int, string>  $dimensions
+     * @return array<int, string>
+     */
+    public function prefetchResource(string $resourceUuid, string $from, string $to, array $dimensions, string $range, int $pathLimit = 50, int $breakdownLimit = 50): array
+    {
+        $this->assertSafeKey($resourceUuid);
+
+        $urls = [$this->appsUrl()];
+        if (Cache::get($this->dashboardAbsenceKey()) !== true) {
+            $urls[] = $this->dashboardUrl($resourceUuid, $from, $to, $range, $pathLimit, $breakdownLimit, 0);
+        }
+        $this->warm($urls);
+
+        $keys = $this->resourceKeys($resourceUuid);
+        $this->prefetchKeys($keys, $from, $to, $dimensions, $range, $pathLimit, $breakdownLimit);
+
+        return $keys;
+    }
+
+    /**
+     * Warm every endpoint for several app keys. One key uses prefetchServerWide(); several
+     * keys batch their dashboard bundles (or, on an older Sentinel, their individual
+     * endpoints) into one exec instead of one SSH round-trip per key.
+     *
+     * @param  array<int, string>  $appKeys
+     * @param  array<int, string>  $dimensions
+     */
+    public function prefetchKeys(array $appKeys, string $from, string $to, array $dimensions, string $range, int $pathLimit = 50, int $breakdownLimit = 50): void
+    {
+        $appKeys = array_values(array_unique($appKeys));
+        if ($appKeys === []) {
+            return;
+        }
+
+        if (count($appKeys) === 1 || ! $this->usesBatchableTransport()) {
+            foreach ($appKeys as $appKey) {
+                $this->prefetchServerWide($appKey, $from, $to, $dimensions, $range, $pathLimit, $breakdownLimit);
+            }
+
+            return;
+        }
+
+        if (Cache::get($this->dashboardAbsenceKey()) !== true) {
+            $dashboardUrls = array_map(
+                fn (string $appKey) => $this->dashboardUrl($appKey, $from, $to, $range, $pathLimit, $breakdownLimit, 0),
+                $appKeys
+            );
+            $this->warm($dashboardUrls);
+
+            if (Cache::has($this->cacheKey($dashboardUrls[0]))) {
+                // Each call now reads its bundle from cache and seeds the per-endpoint cache.
+                foreach ($appKeys as $appKey) {
+                    $this->prefetchServerWide($appKey, $from, $to, $dimensions, $range, $pathLimit, $breakdownLimit);
+                }
+
+                return;
+            }
+
+            // Older Sentinel without the dashboard route: remember it like fetchDashboard() does.
+            Cache::put($this->dashboardAbsenceKey(), true, 60);
+        }
+
+        $urls = [$this->attributionUrl()];
+        foreach ($appKeys as $appKey) {
+            array_push($urls, ...$this->endpointUrls($appKey, $from, $to, $dimensions, $range, $pathLimit, $breakdownLimit));
+        }
+        $this->warm($urls);
+    }
+
     public function attribution(): ?string
     {
         $json = json_decode($this->raw($this->attributionUrl()), true) ?? [];
@@ -139,14 +259,9 @@ class SentinelTrafficClient
 
         // Fallback for older Sentinel without /traffic/dashboard: batch the individual endpoints.
         $urls = [
-            $this->overviewUrl($appKey, $from, $to),
-            $this->pathsUrl($appKey, $from, $to, $pathLimit),
-            $this->seriesUrl($appKey, $range),
+            ...$this->endpointUrls($appKey, $from, $to, $dimensions, $range, $pathLimit, $breakdownLimit),
             $this->attributionUrl(),
         ];
-        foreach ($dimensions as $dimension) {
-            $urls[] = $this->breakdownUrl($appKey, $dimension, $from, $to, $breakdownLimit);
-        }
         // The per-application leaderboard only exists on the unfiltered view.
         if ($appKey === null) {
             $urls[] = $this->appsUrl();
@@ -178,7 +293,7 @@ class SentinelTrafficClient
         // so without a marker every refresh would re-probe over SSH before falling back to the
         // batch. Remember the absence for the same 60s window as the data cache: at most one
         // wasted probe per minute, and a Sentinel upgrade is picked up on the next window.
-        $absenceKey = 'traffic:dashboard-absent:'.$this->server->uuid;
+        $absenceKey = $this->dashboardAbsenceKey();
         if (Cache::get($absenceKey) === true) {
             return null;
         }
@@ -242,6 +357,32 @@ class SentinelTrafficClient
         $this->warm($urls);
     }
 
+    private function dashboardAbsenceKey(): string
+    {
+        return 'traffic:dashboard-absent:'.$this->server->uuid;
+    }
+
+    /**
+     * The individual endpoint urls (overview, paths, series, breakdowns) for one key or the
+     * whole server, used by the batched fallback on Sentinel builds without the dashboard.
+     *
+     * @param  array<int, string>  $dimensions
+     * @return array<int, string>
+     */
+    private function endpointUrls(?string $appKey, string $from, string $to, array $dimensions, string $range, int $pathLimit, int $breakdownLimit): array
+    {
+        $urls = [
+            $this->overviewUrl($appKey, $from, $to),
+            $this->pathsUrl($appKey, $from, $to, $pathLimit),
+            $this->seriesUrl($appKey, $range),
+        ];
+        foreach ($dimensions as $dimension) {
+            $urls[] = $this->breakdownUrl($appKey, $dimension, $from, $to, $breakdownLimit);
+        }
+
+        return $urls;
+    }
+
     private function overviewUrl(?string $appKey, string $from, string $to): string
     {
         $path = $this->appScopedPath($appKey, 'overview');
@@ -324,11 +465,16 @@ class SentinelTrafficClient
      */
     private function assertSafeKey(string $value): void
     {
-        if ($value === '' || ! preg_match('/\A[A-Za-z0-9._:-]+\z/', $value)) {
+        if (! $this->isSafeKey($value)) {
             throw new \InvalidArgumentException('Invalid traffic analytics app key.');
         }
     }
 
+    private function isSafeKey(string $value): bool
+    {
+        return $value !== '' && preg_match('/\A[A-Za-z0-9._:-]+\z/', $value) === 1;
+    }
+
     private function assertSafeDimension(string $dimension): void
     {
         if (! in_array($dimension, self::ALLOWED_DIMENSIONS, true)) {
diff --git a/app/Services/TrafficAnalyticsAggregator.php b/app/Services/TrafficAnalyticsAggregator.php
index 6e057a3816..8ff50dc0fa 100644
--- a/app/Services/TrafficAnalyticsAggregator.php
+++ b/app/Services/TrafficAnalyticsAggregator.php
@@ -4,8 +4,35 @@ namespace App\Services;
 
 use App\Data\Traffic\TrafficOverviewData;
 
+/**
+ * Merges Sentinel traffic data from several sources (servers, or the several app keys of
+ * one resource) into one view. Counters are summed; latency takes the worst value and
+ * uniques are summed, so both are flagged approximate once more than one source is merged.
+ */
 class TrafficAnalyticsAggregator
 {
+    /** @var array<int, TrafficOverviewData> */
+    private array $overviews = [];
+
+    /** @var array<string, array{path: string, domain: ?string, requests: int, bytesOut: int, s4xx: int, s5xx: int, p95: float}> */
+    private array $paths = [];
+
+    /** @var array<string, array<string, array{value: string, requests: int, bytesOut: int}>> */
+    private array $breakdowns;
+
+    /** @var array<int, array<string, int|float>> */
+    private array $series = [];
+
+    private ?string $attribution = null;
+
+    /**
+     * @param  array<int, string>  $dimensions
+     */
+    public function __construct(private array $dimensions = [])
+    {
+        $this->breakdowns = array_fill_keys($dimensions, []);
+    }
+
     /**
      * @param  array<int, TrafficOverviewData>  $overviews
      * @return array{overview: TrafficOverviewData, latencyApproximate: bool, uniquesApproximate: bool}
@@ -36,4 +63,165 @@ class TrafficAnalyticsAggregator
             'uniquesApproximate' => $multi,
         ];
     }
+
+    /**
+     * Fetch every shape for one app key (or the whole server when null) and merge it in.
+     * The series fetch is isolated: a failure (or an older Sentinel without the endpoint)
+     * never discards the other data; an empty series flips the chart to the donut.
+     *
+     * @param  callable(string): ?string  $domainForKey  resolves a path row's app key to its domain
+     */
+    public function collect(SentinelTrafficClient $client, ?string $appKey, string $from, string $to, string $range, callable $domainForKey, int $limit = 50): void
+    {
+        $this->addOverview($client->overview($appKey, $from, $to));
+        $this->addPaths($client->paths($appKey, $from, $to, $limit), $appKey, $domainForKey);
+
+        foreach ($this->dimensions as $dimension) {
+            $this->addBreakdown($dimension, $client->breakdown($appKey, $dimension, $from, $to, $limit));
+        }
+
+        $this->attribution ??= $client->attribution();
+
+        try {
+            $this->addSeries($client->series($appKey, $range));
+        } catch (\Throwable) {
+            // Leave this source out of the series; the donut fallback covers it.
+        }
+    }
+
+    public function addOverview(TrafficOverviewData $overview): void
+    {
+        $this->overviews[] = $overview;
+    }
+
+    /**
+     * Merge path rows keyed by (app, path), so the same path under two apps stays two
+     * rows, each with its own domain. Sentinel's per-row `app` wins; older Sentinel omits
+     * it, so a key-scoped fetch falls back to the key it queried.
+     *
+     * @param  iterable<int, mixed>  $paths
+     * @param  callable(string): ?string  $domainForKey
+     */
+    public function addPaths(iterable $paths, ?string $fallbackAppKey, callable $domainForKey): void
+    {
+        foreach ($paths as $path) {
+            $data = $path->toArray();
+            $pathStr = (string) ($data['path'] ?? '');
+            $appId = (string) ($data['app'] ?? '');
+            $resolveId = $appId !== '' ? $appId : ($fallbackAppKey ?? '');
+            $key = $resolveId."\n".$pathStr;
+
+            $this->paths[$key] ??= [
+                'path' => $pathStr,
+                'domain' => $resolveId !== '' ? $domainForKey($resolveId) : null,
+                'requests' => 0, 'bytesOut' => 0, 's4xx' => 0, 's5xx' => 0, 'p95' => 0.0,
+            ];
+            $this->paths[$key]['requests'] += (int) ($data['requests'] ?? 0);
+            $this->paths[$key]['bytesOut'] += (int) ($data['bytesOut'] ?? 0);
+            $this->paths[$key]['s4xx'] += (int) ($data['s4xx'] ?? 0);
+            $this->paths[$key]['s5xx'] += (int) ($data['s5xx'] ?? 0);
+            $this->paths[$key]['p95'] = max($this->paths[$key]['p95'], (float) ($data['p95'] ?? 0));
+        }
+    }
+
+    /**
+     * @param  iterable<int, mixed>  $rows
+     */
+    public function addBreakdown(string $dimension, iterable $rows): void
+    {
+        foreach ($rows as $row) {
+            $data = $row->toArray();
+            $value = (string) ($data['value'] ?? '');
+
+            $this->breakdowns[$dimension][$value] ??= ['value' => $value, 'requests' => 0, 'bytesOut' => 0];
+            $this->breakdowns[$dimension][$value]['requests'] += (int) ($data['requests'] ?? 0);
+            $this->breakdowns[$dimension][$value]['bytesOut'] += (int) ($data['bytesOut'] ?? 0);
+        }
+    }
+
+    /**
+     * Sum status series by bucket. Uniques are summed (approximate); p95 takes the worst bucket.
+     *
+     * @param  iterable<int, mixed>  $buckets
+     */
+    public function addSeries(iterable $buckets): void
+    {
+        foreach ($buckets as $bucket) {
+            $data = $bucket->toArray();
+            $ts = (int) ($data['bucket'] ?? 0);
+
+            $this->series[$ts] ??= ['bucket' => $ts, 's2xx' => 0, 's3xx' => 0, 's4xx' => 0, 's5xx' => 0, 'requests' => 0, 'bytesIn' => 0, 'bytesOut' => 0, 'uniqueVisitors' => 0, 'p95' => 0.0];
+            foreach (['s2xx', 's3xx', 's4xx', 's5xx', 'requests', 'bytesIn', 'bytesOut', 'uniqueVisitors'] as $field) {
+                $this->series[$ts][$field] += (int) ($data[$field] ?? 0);
+            }
+            $this->series[$ts]['p95'] = max($this->series[$ts]['p95'], (float) ($data['p95'] ?? 0));
+        }
+    }
+
+    public function hasOverview(): bool
+    {
+        return $this->overviews !== [];
+    }
+
+    /**
+     * @return array{overview: TrafficOverviewData, latencyApproximate: bool, uniquesApproximate: bool}
+     */
+    public function overview(): array
+    {
+        return self::sumOverviews($this->overviews);
+    }
+
+    /**
+     * @return array<int, array{path: string, domain: ?string, requests: int, bytesOut: int, s4xx: int, s5xx: int, p95: float}>
+     */
+    public function topPaths(int $limit = 50): array
+    {
+        return self::topByRequests(array_values($this->paths), $limit);
+    }
+
+    /**
+     * @return array<string, array<int, array{value: string, requests: int, bytesOut: int}>>
+     */
+    public function breakdowns(int $limit = 50): array
+    {
+        $result = [];
+        foreach ($this->dimensions as $dimension) {
+            $rows = self::topByRequests(array_values($this->breakdowns[$dimension] ?? []), PHP_INT_MAX);
+            if ($dimension === 'referer') {
+                $rows = groupRefererBreakdownRows($rows);
+            }
+            $result[$dimension] = array_slice($rows, 0, $limit);
+        }
+
+        return $result;
+    }
+
+    /**
+     * @return array<int, array<string, int|float>>
+     */
+    public function series(): array
+    {
+        $series = $this->series;
+        ksort($series);
+
+        return array_values($series);
+    }
+
+    public function attribution(): ?string
+    {
+        return $this->attribution;
+    }
+
+    /**
+     * @template T of array{requests: int}
+     *
+     * @param  array<int, T>  $rows
+     * @return array<int, T>
+     */
+    public static function topByRequests(array $rows, int $limit = 50): array
+    {
+        usort($rows, fn ($a, $b) => $b['requests'] <=> $a['requests']);
+
+        return array_slice($rows, 0, $limit);
+    }
 }
diff --git a/app/Services/TrafficResource.php b/app/Services/TrafficResource.php
new file mode 100644
index 0000000000..e89189c95a
--- /dev/null
+++ b/app/Services/TrafficResource.php
@@ -0,0 +1,189 @@
+<?php
+
+namespace App\Services;
+
+use App\Models\Application;
+use App\Models\ApplicationPreview;
+use App\Models\Server;
+use App\Models\Service;
+use App\Models\ServiceApplication;
+
+/**
+ * A team resource that Sentinel records traffic for: an Application or a Service stack.
+ * Gives the traffic views one way to read its name, server, analytics link, and the
+ * domain behind each of its Sentinel keys (see SentinelTrafficClient::keyBelongsTo()).
+ */
+final class TrafficResource
+{
+    public function __construct(public readonly Application|Service $model) {}
+
+    public static function for(Application|Service $model): self
+    {
+        return new self($model);
+    }
+
+    public function uuid(): string
+    {
+        return (string) $this->model->uuid;
+    }
+
+    public function name(): string
+    {
+        return (string) $this->model->name;
+    }
+
+    public function isService(): bool
+    {
+        return $this->model instanceof Service;
+    }
+
+    public function server(): ?Server
+    {
+        if ($this->model instanceof Service) {
+            return $this->model->server ?? $this->model->destination?->server;
+        }
+
+        return $this->model->destination?->server;
+    }
+
+    public function projectName(): string
+    {
+        return (string) (data_get($this->model, 'environment.project.name') ?: 'Ungrouped');
+    }
+
+    public function analyticsLink(): ?string
+    {
+        $projectUuid = data_get($this->model, 'environment.project.uuid');
+        $environmentUuid = data_get($this->model, 'environment.uuid');
+        if (! $projectUuid || ! $environmentUuid) {
+            return null;
+        }
+
+        if ($this->model instanceof Service) {
+            return route('project.service.analytics', [
+                'project_uuid' => $projectUuid,
+                'environment_uuid' => $environmentUuid,
+                'service_uuid' => $this->model->uuid,
+            ]);
+        }
+
+        return route('project.application.analytics', [
+            'project_uuid' => $projectUuid,
+            'environment_uuid' => $environmentUuid,
+            'application_uuid' => $this->model->uuid,
+        ]);
+    }
+
+    /**
+     * First configured domain host of the resource, or null when it has none.
+     */
+    public function primaryDomain(): ?string
+    {
+        if ($this->model instanceof Service) {
+            foreach ($this->model->applications as $serviceApplication) {
+                if ($host = self::firstHost($serviceApplication->fqdn)) {
+                    return $host;
+                }
+            }
+
+            return null;
+        }
+
+        if ($host = self::firstHost($this->model->fqdn)) {
+            return $host;
+        }
+
+        foreach (self::composeDomains($this->model->docker_compose_domains) as $domain) {
+            if ($host = self::firstHost($domain)) {
+                return $host;
+            }
+        }
+
+        return null;
+    }
+
+    /**
+     * Domain host served under one of this resource's Sentinel keys: the compose service
+     * (`{uuid}-{service}`), the preview (`{uuid}-pr-{pr}` or `{uuid}-{pr}`), or the preview compose service
+     * (`{uuid}-{pr}-{service}`). Falls back to the primary domain.
+     */
+    public function domainForKey(string $key): ?string
+    {
+        if (! SentinelTrafficClient::keyBelongsTo($key, $this->uuid()) || $key === $this->uuid()) {
+            return $this->primaryDomain();
+        }
+
+        $suffix = substr($key, strlen($this->uuid()) + 1);
+
+        if ($this->model instanceof Service) {
+            $serviceApplication = $this->model->applications
+                ->first(fn (ServiceApplication $app) => self::matchesServiceName($suffix, (string) $app->name));
+
+            return self::firstHost($serviceApplication?->fqdn) ?? $this->primaryDomain();
+        }
+
+        // Normal previews use `{uuid}-pr-{id}`, compose previews `{uuid}-{id}` and `{uuid}-{id}-{service}`.
+        if (preg_match('/\A(?:pr-)?(\d+)(?:-(.+))?\z/', $suffix, $matches)) {
+            /** @var ApplicationPreview|null $preview */
+            $preview = $this->model->previews()->where('pull_request_id', (int) $matches[1])->first();
+            if ($preview) {
+                $host = isset($matches[2])
+                    ? self::composeDomainFor($preview->docker_compose_domains, $matches[2])
+                    : self::firstHost($preview->fqdn);
+                if ($host) {
+                    return $host;
+                }
+            }
+        }
+
+        return self::composeDomainFor($this->model->docker_compose_domains, $suffix) ?? $this->primaryDomain();
+    }
+
+    /**
+     * Key suffixes use the label-safe compose service name; accept the raw name too.
+     */
+    private static function matchesServiceName(string $suffix, string $serviceName): bool
+    {
+        return $serviceName !== ''
+            && ($suffix === $serviceName || $suffix === traefikSafeServiceNameSegment($serviceName));
+    }
+
+    private static function composeDomainFor(?string $composeDomains, string $suffix): ?string
+    {
+        foreach (self::composeDomains($composeDomains) as $serviceName => $domain) {
+            if (self::matchesServiceName($suffix, (string) $serviceName)) {
+                return self::firstHost($domain);
+            }
+        }
+
+        return null;
+    }
+
+    /**
+     * @return array<string, string> compose service name => comma-separated domains
+     */
+    private static function composeDomains(?string $json): array
+    {
+        $decoded = json_decode($json ?: '[]', true);
+        if (! is_array($decoded)) {
+            return [];
+        }
+
+        $domains = [];
+        foreach ($decoded as $serviceName => $config) {
+            $domain = data_get($config, 'domain');
+            if (is_string($domain) && trim($domain) !== '') {
+                $domains[(string) $serviceName] = $domain;
+            }
+        }
+
+        return $domains;
+    }
+
+    private static function firstHost(?string $domains): ?string
+    {
+        $first = trim((string) str($domains ?? '')->explode(',')->first());
+
+        return $first !== '' ? (parse_url($first, PHP_URL_HOST) ?: null) : null;
+    }
+}
diff --git a/app/Support/DatabaseImport/DatabaseImportCommandBuilder.php b/app/Support/DatabaseImport/DatabaseImportCommandBuilder.php
index 3568fe3e22..f93c51cc66 100644
--- a/app/Support/DatabaseImport/DatabaseImportCommandBuilder.php
+++ b/app/Support/DatabaseImport/DatabaseImportCommandBuilder.php
@@ -148,25 +148,42 @@ SH;
      */
     private function postgresqlSingle(bool $replaceExisting): string
     {
+        // Every restore runs in one transaction, so a failure part-way rolls back and leaves the
+        // current data as it was, also when --clean dropped objects first.
         $clean = $replaceExisting ? ' --clean --if-exists' : '';
-        $sqlNotice = $replaceExisting ? <<<'SH'
+        $sqlRestore = $replaceExisting ? <<<'SH'
 
-  echo 'SQL backups cannot replace single objects. The database is recreated before the restore.'
-  echo "SELECT pg_terminate_backend(pid) FROM pg_stat_activity WHERE datname = :'db' AND pid <> pg_backend_pid();" | psql -v db="$db" -U $POSTGRES_USER -d template1 >/dev/null || exit 1
-  dropdb --maintenance-db=template1 -U $POSTGRES_USER --if-exists "$db" || exit 1
-  createdb -U $POSTGRES_USER "$db" || exit 1
-SH : '';
+  echo 'SQL backups cannot replace single objects. The backup is restored into a new database first; the current database is replaced only when that restore succeeds.'
+  new=coolify_restore_new
+  old=coolify_restore_old
+  PGOPTIONS='-c client_min_messages=warning' dropdb --maintenance-db=template1 -U $POSTGRES_USER --if-exists "$new" || exit 1
+  createdb -U $POSTGRES_USER "$new" || exit 1
+  if ! stream | psql -v ON_ERROR_STOP=1 --single-transaction -U $POSTGRES_USER -d "$new"; then
+    PGOPTIONS='-c client_min_messages=warning' dropdb --maintenance-db=template1 -U $POSTGRES_USER --if-exists "$new"
+    fail 'The SQL restore failed. The current database was not changed.'
+  fi
+  PGOPTIONS='-c client_min_messages=warning' dropdb --maintenance-db=template1 -U $POSTGRES_USER --if-exists "$old" || exit 1
+  if ! printf '%s\n' "SELECT pg_terminate_backend(pid) FROM pg_stat_activity WHERE datname = :'db' AND pid <> pg_backend_pid();" 'ALTER DATABASE :"db" RENAME TO :"old";' 'ALTER DATABASE :"new" RENAME TO :"db";' | psql -v ON_ERROR_STOP=1 -v db="$db" -v old="$old" -v new="$new" -U $POSTGRES_USER -d template1 >/dev/null; then
+    # Undo a half-done swap: the current database keeps its name and data.
+    printf '%s\n' 'ALTER DATABASE :"old" RENAME TO :"db";' | psql -v db="$db" -v old="$old" -U $POSTGRES_USER -d template1 >/dev/null 2>&1
+    PGOPTIONS='-c client_min_messages=warning' dropdb --maintenance-db=template1 -U $POSTGRES_USER --if-exists "$new"
+    fail 'The current database is in use and could not be replaced. Nothing was changed.'
+  fi
+  PGOPTIONS='-c client_min_messages=warning' dropdb --maintenance-db=template1 -U $POSTGRES_USER --if-exists "$old" || exit 1
+SH : <<<'SH'
+
+  stream | psql -v ON_ERROR_STOP=1 --single-transaction -U $POSTGRES_USER -d "$db"
+SH;
 
         return <<<SH
 db=\${POSTGRES_DB:-\${POSTGRES_USER:-postgres}}
 if [ "\$(stream | head -c 5)" = PGDMP ] || is_tar; then
-  stream | pg_restore --exit-on-error{$clean} -U \$POSTGRES_USER -d "\$db"
+  stream | pg_restore --exit-on-error --single-transaction{$clean} -U \$POSTGRES_USER -d "\$db"
 elif ! is_text; then
   fail 'Unsupported PostgreSQL backup format. Use a pg_dump archive (custom or tar format) or an SQL file.'
 elif stream | head -c 4096 | grep -q 'PostgreSQL database cluster dump'; then
   fail 'This backup contains all databases. Select "Backup contains all databases" to restore it.'
-else{$sqlNotice}
-  stream | psql -v ON_ERROR_STOP=1 -U \$POSTGRES_USER -d "\$db"
+else{$sqlRestore}
 fi
 SH;
     }
diff --git a/app/Support/ResourceStartActivity.php b/app/Support/ResourceStartActivity.php
index e4baaec978..25a75e09e2 100644
--- a/app/Support/ResourceStartActivity.php
+++ b/app/Support/ResourceStartActivity.php
@@ -8,17 +8,20 @@ use Illuminate\Support\Collection;
 use Spatie\Activitylog\Models\Activity;
 
 /**
- * State of the activity log rows that track database and service start/restart runs.
+ * State of the activity log rows that track database and service start/restart runs
+ * and database imports.
  *
  * A killed worker, a Coolify restart or a lost queue can leave such an activity queued or
  * in progress forever. Activities that have not progressed for longer than their job can
- * possibly run are treated as stale, so they no longer block Start/Restart in the UI.
+ * possibly run are treated as stale, so they no longer block Start/Restart/Import.
  * Command output is saved to the activity as it arrives, so `updated_at` is the heartbeat.
  */
 class ResourceStartActivity
 {
     public const DATABASE_START_OPERATION = 'database-start';
 
+    public const DATABASE_IMPORT_OPERATION = 'database_import';
+
     /**
      * A start that is still waiting in the queue after this long is treated as lost.
      */
@@ -29,8 +32,34 @@ class ResourceStartActivity
      */
     public const IN_PROGRESS_STALE_AFTER_SECONDS = 900;
 
+    /**
+     * A restore can be silent for a long time (for example pg_restore without verbose output),
+     * so the output heartbeat is not reliable for imports. The remote restore process is killed
+     * after the SSH command timeout, so an import without progress for longer than that plus
+     * this margin cannot still be running.
+     */
+    public const IMPORT_STALE_MARGIN_SECONDS = 1800;
+
+    /**
+     * Lower bound for the import limit, also used when the SSH command timeout is disabled (0).
+     */
+    public const IMPORT_MIN_STALE_AFTER_SECONDS = 7200;
+
+    /**
+     * The start lock must not outlive a killed job for long: DatabaseStartJob times out after 600 seconds.
+     */
+    public const DATABASE_START_LOCK_SECONDS = self::IN_PROGRESS_STALE_AFTER_SECONDS;
+
     public const INTERRUPTED_MESSAGE = 'Interrupted by a Coolify restart.';
 
+    public const STALE_MESSAGE = 'Marked as failed: no progress was recorded for too long.';
+
+    public const SUPERSEDED_MESSAGE = 'Skipped: a newer start of this database was requested.';
+
+    public const ALREADY_STARTING_MESSAGE = 'Skipped: another start of this database is still running.';
+
+    public const DATABASE_OPERATION_IN_PROGRESS_MESSAGE = 'Another start, restart or import of this database is already in progress.';
+
     private const ACTIVE_STATUSES = [
         ProcessStatus::QUEUED->value,
         ProcessStatus::IN_PROGRESS->value,
@@ -65,13 +94,58 @@ class ResourceStartActivity
             return true;
         }
 
-        $staleAfterSeconds = data_get($activity, 'properties.status') === ProcessStatus::QUEUED->value
-            ? self::QUEUED_STALE_AFTER_SECONDS
-            : self::IN_PROGRESS_STALE_AFTER_SECONDS;
+        $staleAfterSeconds = match (true) {
+            data_get($activity, 'properties.operation') === self::DATABASE_IMPORT_OPERATION => self::importStaleAfterSeconds(),
+            data_get($activity, 'properties.status') === ProcessStatus::QUEUED->value => self::QUEUED_STALE_AFTER_SECONDS,
+            default => self::IN_PROGRESS_STALE_AFTER_SECONDS,
+        };
 
         return $lastProgressAt->lte(now()->subSeconds($staleAfterSeconds));
     }
 
+    public static function importStaleAfterSeconds(): int
+    {
+        $commandTimeout = (int) config('constants.ssh.command_timeout');
+
+        return max(self::IMPORT_MIN_STALE_AFTER_SECONDS, $commandTimeout + self::IMPORT_STALE_MARGIN_SECONDS);
+    }
+
+    public static function databaseStartLockKey(string $databaseUuid): string
+    {
+        return "database-start:{$databaseUuid}";
+    }
+
+    /**
+     * Queued or in-progress activities of one operation for a resource, oldest first.
+     *
+     * @return Collection<int, Activity>
+     */
+    public static function active(string $typeUuid, string $operation, ?int $teamId = null): Collection
+    {
+        return Activity::query()
+            ->where('properties->type_uuid', $typeUuid)
+            ->where('properties->operation', $operation)
+            ->whereIn('properties->status', self::ACTIVE_STATUSES)
+            ->when($teamId !== null, fn ($query) => $query->where('properties->team_id', $teamId))
+            ->orderBy('id')
+            ->get();
+    }
+
+    /**
+     * Fail the stale activities in the list, so the UI and API stop reporting them as running.
+     *
+     * @param  Collection<int, Activity>  $activities
+     * @return Collection<int, Activity> The activities that are not stale.
+     */
+    public static function failStale(Collection $activities): Collection
+    {
+        [$stale, $live] = $activities->partition(fn (Activity $activity): bool => self::isStale($activity));
+
+        $stale->each(fn (Activity $activity) => self::markFailed($activity, self::STALE_MESSAGE));
+
+        return $live->values();
+    }
+
     /**
      * Mark an activity as failed, append the reason to its log and stop log polling.
      */
@@ -92,8 +166,8 @@ class ResourceStartActivity
     }
 
     /**
-     * Fail database and service start activities left queued or in progress by a restart.
-     * Runs during app:init, before any queue worker is started.
+     * Fail database starts, database imports and service starts left queued or in progress
+     * by a restart. Runs during app:init, before any queue worker is started.
      */
     public static function failInterrupted(): int
     {
@@ -104,7 +178,11 @@ class ResourceStartActivity
         $serviceUuids = self::existingServiceUuids($activities);
 
         $interrupted = $activities->filter(
-            fn (Activity $activity): bool => data_get($activity, 'properties.operation') === self::DATABASE_START_OPERATION
+            fn (Activity $activity): bool => in_array(
+                data_get($activity, 'properties.operation'),
+                [self::DATABASE_START_OPERATION, self::DATABASE_IMPORT_OPERATION],
+                true,
+            )
                 || $serviceUuids->contains(data_get($activity, 'properties.type_uuid'))
         );
 
diff --git a/app/Traits/ExecuteRemoteCommand.php b/app/Traits/ExecuteRemoteCommand.php
index 0d8dfdc29f..5a4540ea3a 100644
--- a/app/Traits/ExecuteRemoteCommand.php
+++ b/app/Traits/ExecuteRemoteCommand.php
@@ -16,6 +16,8 @@ trait ExecuteRemoteCommand
 {
     use SshRetryable;
 
+    private const SENSITIVE_COMMAND_PLACEHOLDER = '[command hidden because it contains sensitive data]';
+
     public ?string $save = null;
 
     public static int $batch_counter = 0;
@@ -184,7 +186,7 @@ trait ExecuteRemoteCommand
 
             $new_log_entry = [
                 'command' => $skip_command_log || $command_hidden ? null : $this->redact_sensitive_info($command),
-                'output' => $this->redact_sensitive_info($log_output),
+                'output' => $this->redact_sensitive_info($skip_command_log ? $this->redactSensitiveCommandPayloads((string) $log_output, (string) $command) : $log_output),
                 'type' => $customType ?? ($type === 'err' ? 'stderr' : 'stdout'),
                 'timestamp' => Carbon::now('UTC'),
                 'hidden' => $hidden,
@@ -241,12 +243,54 @@ trait ExecuteRemoteCommand
                 if (empty($error)) {
                     $error = $process_result->output() ?: 'Command failed with no error output';
                 }
-                $redactedCommand = $this->redact_sensitive_info($command);
-                throw new DeploymentException("Command execution failed (exit code {$process_result->exitCode()}): {$redactedCommand}\nError: {$error}");
+                throw new DeploymentException($this->commandFailureMessage((string) $command, (int) $process_result->exitCode(), (string) $error, $skip_command_log));
             }
         }
     }
 
+    /**
+     * Commands marked with skip_command_log embed secrets (for example base64 encoded .env files or
+     * private keys), so their text must never reach a log line or an exception message.
+     */
+    private function commandFailureMessage(string $command, int $exitCode, string $error, bool $isSensitiveCommand): string
+    {
+        if ($isSensitiveCommand) {
+            $commandText = self::SENSITIVE_COMMAND_PLACEHOLDER;
+            $error = $this->redactSensitiveCommandPayloads($error, $command);
+        } else {
+            $commandText = $this->redact_sensitive_info($command);
+        }
+
+        $error = $this->redact_sensitive_info($error);
+
+        return "Command execution failed (exit code {$exitCode}): {$commandText}\nError: {$error}";
+    }
+
+    /**
+     * Removes the encoded payloads of a sensitive command from output that could echo the command.
+     */
+    private function redactSensitiveCommandPayloads(string $text, string $command): string
+    {
+        if ($text === '' || preg_match_all('~[A-Za-z0-9+/]{16,}={0,2}~', $command, $matches) === false) {
+            return $text;
+        }
+
+        $payloads = collect($matches[0])
+            ->unique()
+            ->filter(function (string $candidate): bool {
+                $decoded = base64_decode($candidate, true);
+
+                return $decoded !== false
+                    && mb_check_encoding($decoded, 'UTF-8')
+                    && preg_match('/[^\P{C}\t\n\r]/u', $decoded) !== 1;
+            })
+            ->sortByDesc(fn (string $payload): int => strlen($payload))
+            ->values()
+            ->all();
+
+        return $payloads === [] ? $text : str_replace($payloads, REDACTED, $text);
+    }
+
     private function saveCommandOutput(string $output, bool $append): void
     {
         if (! $this->save) {
diff --git a/bootstrap/helpers/docker.php b/bootstrap/helpers/docker.php
index 898e6d7412..746d2c2691 100644
--- a/bootstrap/helpers/docker.php
+++ b/bootstrap/helpers/docker.php
@@ -43,6 +43,19 @@ function traefikSafeServiceNameSegment(string $serviceName): string
     return $normalized.'-'.traefikServiceNameHash($serviceName);
 }
 
+/**
+ * Key that Sentinel uses to group Caddy access-log lines. It is the same key that Sentinel gets
+ * from the Traefik router name (`https-{i}-{KEY}@docker`), so both proxies report a resource the same way.
+ * Only [A-Za-z0-9-] can occur, so the value is safe in a Docker label and in a Caddyfile.
+ */
+function caddyTrafficAppKey(string $uuid, ?string $serviceName = null): string
+{
+    // Same truthiness check as fqdnLabelsForTraefik(), so the keys stay equal.
+    $key = $serviceName ? $uuid.'-'.traefikSafeServiceNameSegment($serviceName) : $uuid;
+
+    return (string) preg_replace('/[^A-Za-z0-9-]+/', '-', $key);
+}
+
 function getCurrentApplicationContainerStatus(Server $server, int $id, ?int $pullRequestId = null, ?bool $includePullrequests = false): Collection
 {
     $containers = collect([]);
@@ -559,6 +572,8 @@ function fqdnLabelsForCaddy(string $network, string $uuid, Collection $domains,
         $hashedPassword = password_hash($http_basic_auth_password, PASSWORD_BCRYPT, ['cost' => 10]);
     }
 
+    $trafficAppKey = caddyTrafficAppKey($uuid, $service_name);
+
     foreach ($domains as $loop => $domain) {
         $url = Url::fromString($domain);
         $host = $url->getHost();
@@ -623,7 +638,7 @@ function fqdnLabelsForCaddy(string $network, string $uuid, Collection $domains,
             $labels->push("caddy_{$loop}.log.format=json");
             // Only Caddy 2.8+ knows log_append; see Server::caddySupportsLogAppend().
             if ($supports_log_append) {
-                $labels->push("caddy_{$loop}.log_append=coolify_app_id {$uuid}");
+                $labels->push("caddy_{$loop}.log_append=coolify_app_id {$trafficAppKey}");
             }
         }
     }
diff --git a/bootstrap/helpers/parsers.php b/bootstrap/helpers/parsers.php
index 4c5dff37cc..c0fc2d731b 100644
--- a/bootstrap/helpers/parsers.php
+++ b/bootstrap/helpers/parsers.php
@@ -1510,6 +1510,8 @@ function applicationParser(Application $resource, int $pull_request_id = 0, ?int
                 ? ($previewForPorts?->domain_port_overrides ?? [])
                 : ($originalResource->domain_port_overrides ?? []);
             $onlyPort = firstDockerComposeServicePort($service);
+            $isTrafficAnalyticsEnabled = (bool) $server?->isTrafficAnalyticsEnabled();
+            $supportsLogAppend = (bool) $server?->caddySupportsLogAppend();
             if (! $use_network_mode && (! $shouldGenerateLabelsExactly || $server->proxyType() === ProxyTypes::TRAEFIK->value)) {
                 $serviceLabels = addTraefikDockerNetworkLabel($serviceLabels, $baseNetwork->first());
             }
@@ -1547,6 +1549,8 @@ function applicationParser(Application $resource, int $pull_request_id = 0, ?int
                             noindex_domains: $noindexDomains,
                             redirect_direction: $redirectDirection,
                             domainPortOverrides: $domainPortOverrides,
+                            is_traffic_analytics_enabled: $isTrafficAnalyticsEnabled,
+                            supports_log_append: $supportsLogAppend,
                         ));
                         break;
                 }
@@ -1580,6 +1584,8 @@ function applicationParser(Application $resource, int $pull_request_id = 0, ?int
                     noindex_domains: $noindexDomains,
                     redirect_direction: $redirectDirection,
                     domainPortOverrides: $domainPortOverrides,
+                    is_traffic_analytics_enabled: $isTrafficAnalyticsEnabled,
+                    supports_log_append: $supportsLogAppend,
                 ));
             }
         }
@@ -2766,6 +2772,8 @@ function serviceParser(Service $resource): Collection
             $onlyPort = $originalResource instanceof ServiceApplication
                 ? $originalResource->getRequiredPort()
                 : $predefinedPort;
+            $isTrafficAnalyticsEnabled = (bool) $server?->isTrafficAnalyticsEnabled();
+            $supportsLogAppend = (bool) $server?->caddySupportsLogAppend();
             if (! $use_network_mode && (! $shouldGenerateLabelsExactly || $server->proxyType() === ProxyTypes::TRAEFIK->value)) {
                 $serviceLabels = addTraefikDockerNetworkLabel($serviceLabels, $baseNetwork->first());
             }
@@ -2802,7 +2810,9 @@ function serviceParser(Service $resource): Collection
                             predefinedPort: $onlyPort,
                             domainPortOverrides: $originalResource->domain_port_overrides ?? [],
                             noindex_domains: $noindexDomains,
-                            redirect_direction: $redirectDirection
+                            redirect_direction: $redirectDirection,
+                            is_traffic_analytics_enabled: $isTrafficAnalyticsEnabled,
+                            supports_log_append: $supportsLogAppend,
                         ));
                         break;
                 }
@@ -2835,7 +2845,9 @@ function serviceParser(Service $resource): Collection
                     predefinedPort: $onlyPort,
                     domainPortOverrides: $originalResource->domain_port_overrides ?? [],
                     noindex_domains: $noindexDomains,
-                    redirect_direction: $redirectDirection
+                    redirect_direction: $redirectDirection,
+                    is_traffic_analytics_enabled: $isTrafficAnalyticsEnabled,
+                    supports_log_append: $supportsLogAppend,
                 ));
             }
         }
diff --git a/bootstrap/helpers/proxy.php b/bootstrap/helpers/proxy.php
index 68a2c93a15..6e70b2fcb1 100644
--- a/bootstrap/helpers/proxy.php
+++ b/bootstrap/helpers/proxy.php
@@ -45,43 +45,139 @@ function applyTrafficAnalyticsToProxyConfiguration(Server $server, string $confi
     return Yaml::dump($config, 12, 2);
 }
 
+/**
+ * Server proxy attribute that remembers the user's own `--accesslog*` Traefik flags while
+ * traffic analytics replaces them with the managed set, so disabling can restore them exactly.
+ */
+const TRAEFIK_USER_ACCESSLOG_COMMANDS_KEY = 'traffic_analytics_user_accesslog_commands';
+
+function isTraefikAccessLogCommand(mixed $command): bool
+{
+    if (! is_string($command)) {
+        return false;
+    }
+
+    $flag = strtolower(explode('=', $command, 2)[0]);
+
+    return $flag === '--accesslog' || str_starts_with($flag, '--accesslog.');
+}
+
+/**
+ * Rotates the Traefik access log with BusyBox tools from the Alpine base image only (no package
+ * install, no network). Uses copytruncate semantics: Traefik keeps its file handle and Sentinel's
+ * tailer handles the truncation. Keeps at most 5 gzip-compressed rotations (access.log.1.gz..5.gz).
+ * The environment overrides exist for tests; the sidecar does not set them.
+ */
+function traefikAccessLogRotationScript(): string
+{
+    return <<<'SH'
+log="${TRAEFIK_ACCESS_LOG:-/traefik/access.log}"
+max_bytes="${TRAEFIK_ACCESS_LOG_MAX_BYTES:-20971520}"
+interval="${TRAEFIK_ACCESS_LOG_ROTATE_INTERVAL:-60}"
+keep=5
+while true; do
+  size=$(stat -c %s "$log" 2>/dev/null || echo 0)
+  if [ "$size" -gt "$max_bytes" ]; then
+    rm -f "$log.$keep.gz"
+    i=$((keep - 1))
+    while [ "$i" -ge 1 ]; do
+      if [ -f "$log.$i.gz" ]; then mv -f "$log.$i.gz" "$log.$((i + 1)).gz"; fi
+      i=$((i - 1))
+    done
+    if cp "$log" "$log.1"; then
+      : > "$log"
+      gzip -f "$log.1"
+    fi
+  fi
+  sleep "$interval"
+done
+SH;
+}
+
+/**
+ * Replace the user's own access log flags with the managed set while analytics is enabled, and
+ * restore them exactly when it is disabled. Flags that were never added by Coolify are kept.
+ *
+ * @param  array<int, mixed>  $commands
+ * @return array<int, mixed>
+ */
+function applyTraefikAccessLogCommands(Server $server, array $commands, bool $enabled): array
+{
+    $managedCommands = traefikAccessLogCommands(true);
+    $storedUserCommands = $server->proxy->get(TRAEFIK_USER_ACCESSLOG_COMMANDS_KEY);
+    $hasStoredUserCommands = is_array($storedUserCommands);
+    $userCommands = $hasStoredUserCommands ? array_values($storedUserCommands) : [];
+
+    // Managed flags are Coolify's when their user flags were remembered on enable, or (analytics
+    // enabled before flags were remembered) when the complete managed set is present. Otherwise a
+    // matching flag such as `--accesslog=true` belongs to the user and is kept.
+    $managedCommandsAddedByCoolify = $hasStoredUserCommands || array_diff($managedCommands, $commands) === [];
+    if ($managedCommandsAddedByCoolify) {
+        $commands = array_values(array_filter(
+            $commands,
+            fn (mixed $command): bool => ! in_array($command, $managedCommands, true)
+        ));
+    }
+
+    if ($enabled) {
+        foreach ($commands as $command) {
+            if (isTraefikAccessLogCommand($command) && ! in_array($command, $userCommands, true)) {
+                $userCommands[] = $command;
+            }
+        }
+
+        $commands = [
+            ...array_filter($commands, fn (mixed $command): bool => ! isTraefikAccessLogCommand($command)),
+            ...$managedCommands,
+        ];
+
+        if ($storedUserCommands !== $userCommands) {
+            $server->proxy->set(TRAEFIK_USER_ACCESSLOG_COMMANDS_KEY, $userCommands);
+            $server->save();
+        }
+    } elseif ($hasStoredUserCommands) {
+        foreach ($userCommands as $command) {
+            if (! in_array($command, $commands, true)) {
+                $commands[] = $command;
+            }
+        }
+
+        $server->proxy->forget(TRAEFIK_USER_ACCESSLOG_COMMANDS_KEY);
+        $server->save();
+    }
+
+    return array_values($commands);
+}
+
 function applyTrafficAnalyticsToProxyConfigArray(Server $server, array $config): array
 {
     $enabled = $server->isTrafficAnalyticsEnabled();
 
     if ($server->proxyType() === ProxyTypes::TRAEFIK->value) {
-        $managedCommands = traefikAccessLogCommands(true);
         $commands = data_get($config, 'services.traefik.command', []);
 
         if (! is_array($commands)) {
             throw new RuntimeException('Traefik commands must be a YAML list.');
         }
 
-        $commands = array_values(array_filter(
-            $commands,
-            fn (mixed $command): bool => ! in_array($command, $managedCommands, true)
-        ));
-
-        if ($enabled) {
-            $commands = [...$commands, ...$managedCommands];
-        }
-
-        data_set($config, 'services.traefik.command', $commands);
+        data_set($config, 'services.traefik.command', applyTraefikAccessLogCommands($server, $commands, $enabled));
         unset($config['services']['traefik-logrotate']);
 
         if ($enabled && ! $server->isSwarm() && ! isDev()) {
             $proxyPath = $server->proxyPath();
             $config['services']['traefik-logrotate'] = [
                 'container_name' => 'coolify-proxy-logrotate',
-                'image' => 'alpine:3.20',
+                'image' => 'alpine:3.24',
                 'restart' => RESTART_MODE,
+                'network_mode' => 'none',
                 'volumes' => [
                     "{$proxyPath}:/traefik",
                 ],
                 'labels' => [
                     'coolify.managed=true',
                 ],
-                'entrypoint' => 'sh -c \'apk add --no-cache logrotate >/dev/null 2>&1; printf "/traefik/access.log {\n  copytruncate\n  size 20M\n  rotate 5\n  compress\n  missingok\n  notifempty\n}\n" > /etc/logrotate.d/traefik-access; while true; do logrotate -s /traefik/.logrotate.state /etc/logrotate.d/traefik-access; sleep 3600; done\'',
+                // Docker Compose interpolates `$VAR`, so every `$` is escaped as `$$`.
+                'entrypoint' => ['/bin/sh', '-c', str_replace('$', '$$', traefikAccessLogRotationScript())],
             ];
         }
     } elseif ($server->proxyType() === ProxyTypes::CADDY->value) {
@@ -326,6 +422,97 @@ function extractCustomProxyCommands(Server $server, string $existing_config): ar
 
     return $custom_commands;
 }
+
+/**
+ * Removes the dashboard router labels that older Coolify versions generated for Traefik.
+ * These labels route requests with the proxy container name as Host header to the Traefik API and dashboard.
+ * Comments and formatting are kept. A router or label set that the user changed is not touched.
+ */
+function removeLegacyTraefikDashboardLabels(string $configuration): string
+{
+    $legacyLabels = [
+        'traefik.enable=true',
+        'traefik.http.routers.traefik.entrypoints=http',
+        'traefik.http.routers.traefik.service=api@internal',
+        'traefik.http.services.traefik.loadbalancer.server.port=8080',
+    ];
+
+    try {
+        $yaml = Yaml::parse($configuration);
+    } catch (Throwable) {
+        return $configuration;
+    }
+
+    $expected = $yaml;
+    $changed = false;
+    foreach (['services.traefik.labels', 'services.traefik.deploy.labels'] as $path) {
+        $labels = data_get($yaml, $path);
+        if (! is_array($labels) || ! array_is_list($labels) || array_filter($labels, 'is_string') !== $labels) {
+            continue;
+        }
+
+        $traefikLabels = array_filter($labels, fn (string $label) => str_starts_with($label, 'traefik.'));
+        if (! in_array('traefik.http.routers.traefik.service=api@internal', $traefikLabels, true) || array_diff($traefikLabels, $legacyLabels) !== []) {
+            continue;
+        }
+
+        $newLabels = [];
+        foreach ($labels as $label) {
+            if ($label === 'traefik.enable=true') {
+                $newLabels[] = 'traefik.enable=false';
+            } elseif (! in_array($label, $legacyLabels, true)) {
+                $newLabels[] = $label;
+            }
+        }
+        data_set($expected, $path, $newLabels);
+        $changed = true;
+    }
+
+    if (! $changed) {
+        return $configuration;
+    }
+
+    $fixed = preg_replace('/^([ \t]*-[ \t]*([\'"]?))traefik\.enable=true(\2[ \t]*)(?=\R|\z)/m', '$1traefik.enable=false$3', $configuration);
+    foreach (array_slice($legacyLabels, 1) as $label) {
+        $fixed = preg_replace('/^[ \t]*-[ \t]*([\'"]?)'.preg_quote($label, '/').'\1[ \t]*(?:\R|\z)/m', '', $fixed);
+    }
+
+    // Keep the original when the line edit also changed other parts of the file.
+    try {
+        return Yaml::parse($fixed) === $expected ? $fixed : $configuration;
+    } catch (Throwable) {
+        return $configuration;
+    }
+}
+
+/**
+ * Saves the Traefik configuration without the legacy dashboard labels. The next proxy restart applies it.
+ */
+function removeLegacyTraefikDashboardExposure(Server $server): bool
+{
+    $configuration = $server->proxy->get('last_saved_proxy_configuration');
+    if ($server->proxyType() !== ProxyTypes::TRAEFIK->value || ! is_string($configuration) || blank($configuration)) {
+        return false;
+    }
+
+    $fixed = removeLegacyTraefikDashboardLabels($configuration);
+    if ($fixed === $configuration) {
+        return false;
+    }
+
+    // The running proxy still uses the old configuration, so the UI must ask for a restart.
+    if (blank($server->proxy->get('last_applied_settings'))) {
+        $server->proxy->last_applied_settings = md5(base64_encode($configuration));
+    }
+    $server->proxy->last_saved_proxy_configuration = $fixed;
+    $server->proxy->last_saved_settings = md5(base64_encode($fixed));
+    $server->save();
+
+    Log::info('Removed legacy Traefik dashboard labels from the proxy configuration', ['server_id' => $server->id]);
+
+    return true;
+}
+
 function generateDefaultProxyConfiguration(Server $server, array $custom_commands = [])
 {
     Log::info('Generating default proxy configuration', [
diff --git a/bootstrap/helpers/remoteProcess.php b/bootstrap/helpers/remoteProcess.php
index 241368d388..8e767ed484 100644
--- a/bootstrap/helpers/remoteProcess.php
+++ b/bootstrap/helpers/remoteProcess.php
@@ -25,7 +25,8 @@ function remote_process(
     ?Model $model = null,
     bool $ignore_errors = false,
     $callEventOnFinish = null,
-    $callEventData = null
+    $callEventData = null,
+    array $properties = [],
 ): Activity {
     $type = $type ?? ActivityTypes::INLINE->value;
     $command = $command instanceof Collection ? $command->toArray() : $command;
@@ -46,6 +47,7 @@ function remote_process(
     SshMultiplexingHelper::ensureMultiplexedConnection($server);
 
     $properties = [
+        ...$properties,
         'server_uuid' => $server->uuid,
         'command' => $command_string,
         'type' => $type,
diff --git a/bootstrap/helpers/shared.php b/bootstrap/helpers/shared.php
index 88bdf12038..d9589ad6d9 100644
--- a/bootstrap/helpers/shared.php
+++ b/bootstrap/helpers/shared.php
@@ -3191,6 +3191,8 @@ function parseDockerComposeFile(Service|Application $resource, bool $isNew = fal
                                         noindex_domains: $noindexDomains,
                                         redirect_direction: $redirectDirection,
                                         domainPortOverrides: $domainPortOverrides,
+                                        is_traffic_analytics_enabled: $resource->server?->isTrafficAnalyticsEnabled() ?? false,
+                                        supports_log_append: $resource->server?->caddySupportsLogAppend() ?? false,
                                     ));
                                     break;
                             }
@@ -3224,6 +3226,8 @@ function parseDockerComposeFile(Service|Application $resource, bool $isNew = fal
                                 noindex_domains: $noindexDomains,
                                 redirect_direction: $redirectDirection,
                                 domainPortOverrides: $domainPortOverrides,
+                                is_traffic_analytics_enabled: $resource->server?->isTrafficAnalyticsEnabled() ?? false,
+                                supports_log_append: $resource->server?->caddySupportsLogAppend() ?? false,
                             ));
                         }
                     }
@@ -3995,6 +3999,7 @@ function parseDockerComposeFile(Service|Application $resource, bool $isNew = fal
                                             domains: $fqdns,
                                             serviceLabels: $serviceLabels,
                                             image: data_get($service, 'image'),
+                                            service_name: $serviceName,
                                             is_force_https_enabled: $resource->isForceHttpsEnabled(),
                                             is_gzip_enabled: $resource->isGzipEnabled(),
                                             is_stripprefix_enabled: $resource->isStripprefixEnabled(),
@@ -4002,6 +4007,8 @@ function parseDockerComposeFile(Service|Application $resource, bool $isNew = fal
                                             noindex_domains: $noindexDomains,
                                             redirect_direction: $redirectDirection,
                                             domainPortOverrides: $domainPortOverrides,
+                                            is_traffic_analytics_enabled: $server?->isTrafficAnalyticsEnabled() ?? false,
+                                            supports_log_append: $server?->caddySupportsLogAppend() ?? false,
                                         )
                                     );
                                     break;
@@ -4030,6 +4037,7 @@ function parseDockerComposeFile(Service|Application $resource, bool $isNew = fal
                                     domains: $fqdns,
                                     serviceLabels: $serviceLabels,
                                     image: data_get($service, 'image'),
+                                    service_name: $serviceName,
                                     is_force_https_enabled: $resource->isForceHttpsEnabled(),
                                     is_gzip_enabled: $resource->isGzipEnabled(),
                                     is_stripprefix_enabled: $resource->isStripprefixEnabled(),
@@ -4037,6 +4045,8 @@ function parseDockerComposeFile(Service|Application $resource, bool $isNew = fal
                                     noindex_domains: $noindexDomains,
                                     redirect_direction: $redirectDirection,
                                     domainPortOverrides: $domainPortOverrides,
+                                    is_traffic_analytics_enabled: $server?->isTrafficAnalyticsEnabled() ?? false,
+                                    supports_log_append: $server?->caddySupportsLogAppend() ?? false,
                                 )
                             );
                         }
diff --git a/database/migrations/2026_09_25_210000_remove_legacy_traefik_dashboard_labels.php b/database/migrations/2026_09_25_210000_remove_legacy_traefik_dashboard_labels.php
new file mode 100644
index 0000000000..9bab033205
--- /dev/null
+++ b/database/migrations/2026_09_25_210000_remove_legacy_traefik_dashboard_labels.php
@@ -0,0 +1,38 @@
+<?php
+
+use App\Models\Server;
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Support\Facades\Log;
+
+return new class extends Migration
+{
+    /**
+     * Save each server on its own. In Postgres one failed update aborts a shared transaction and stops the upgrade.
+     */
+    public $withinTransaction = false;
+
+    /**
+     * Remove the Traefik dashboard router labels from saved proxy configurations.
+     * Only the database is changed. The proxy shows a restart notice and applies the fix on the next restart.
+     */
+    public function up(): void
+    {
+        Server::query()->chunkById(100, function ($servers) {
+            foreach ($servers as $server) {
+                try {
+                    removeLegacyTraefikDashboardExposure($server);
+                } catch (Throwable $e) {
+                    Log::warning('Could not remove legacy Traefik dashboard labels', [
+                        'server_id' => $server->id,
+                        'error' => $e->getMessage(),
+                    ]);
+                }
+            }
+        });
+    }
+
+    public function down(): void
+    {
+        //
+    }
+};
diff --git a/docker/coolify-terminal/terminal-server.js b/docker/coolify-terminal/terminal-server.js
index a955247dca..394cf5277d 100755
--- a/docker/coolify-terminal/terminal-server.js
+++ b/docker/coolify-terminal/terminal-server.js
@@ -4,6 +4,9 @@ import pty from 'node-pty';
 import { parseCookie } from 'cookie';
 import 'dotenv/config';
 import {
+    TERMINAL_CLOSE_CODES,
+    authenticateTerminalUpgrade,
+    createTerminalUpgradeHandler,
     extractHereDocContent,
     extractSshArgs,
     extractTargetHost,
@@ -11,6 +14,7 @@ import {
     getTerminalProcessEnv,
     getTerminalSessionTimeout,
     isAuthorizedTargetHost,
+    rejectTerminalSocket,
     sanitizeSshArgs,
     validateSshArgs,
 } from './terminal-utils.js';
@@ -117,54 +121,44 @@ const getSessionCookie = (req) => {
     }
 }
 
-const verifyClient = async (info, callback) => {
-    const { xsrfToken, laravelSession, sessionCookieName } = getSessionCookie(info.req);
+const verifyClient = async (req) => {
+    const sessionCookie = getSessionCookie(req);
     const requestContext = {
-        remoteAddress: info.req.socket?.remoteAddress,
-        origin: info.origin,
-        sessionCookieName,
-        hasXsrfToken: Boolean(xsrfToken),
-        hasLaravelSession: Boolean(laravelSession),
+        remoteAddress: req.socket?.remoteAddress,
+        origin: req.headers.origin,
+        sessionCookieName: sessionCookie.sessionCookieName,
+        hasXsrfToken: Boolean(sessionCookie.xsrfToken),
+        hasLaravelSession: Boolean(sessionCookie.laravelSession),
     };
 
     logTerminal('log', 'Verifying websocket client.', requestContext);
 
-    // Verify presence of required tokens
-    if (!laravelSession || !xsrfToken) {
-        logTerminal('warn', 'Rejecting websocket client because required auth tokens are missing.', requestContext);
-        return callback(false, 401, 'Unauthorized: Missing required tokens');
-    }
+    // Authenticate with Laravel backend
+    const result = await authenticateTerminalUpgrade(sessionCookie, postToCoolify);
 
-    try {
-        // Authenticate with Laravel backend
-        const response = await postToCoolify('/terminal/auth', {
-            'Cookie': `${sessionCookieName}=${laravelSession}`,
-            'X-XSRF-TOKEN': xsrfToken
-        });
-
-        if (response.status === 200) {
-            logTerminal('log', 'Websocket client authentication succeeded.', requestContext);
-            callback(true);
-        } else {
-            logTerminal('warn', 'Websocket client authentication returned a non-success status.', {
-                ...requestContext,
-                status: response.status,
-            });
-            callback(false, 401, 'Unauthorized: Invalid credentials');
-        }
-    } catch (error) {
+    if (result.authenticated) {
+        logTerminal('log', 'Websocket client authentication succeeded.', requestContext);
+    } else if (result.error) {
         logTerminal('error', 'Websocket client authentication failed.', {
             ...requestContext,
-            error: error.message,
-            responseStatus: error.response?.status,
-            responseData: error.response?.data,
+            error: result.error.message,
+        });
+    } else {
+        logTerminal('warn', 'Rejecting websocket client.', {
+            ...requestContext,
+            reason: result.reason,
+            status: result.status,
+            closeCode: result.closeCode,
         });
-        callback(false, 500, 'Internal Server Error');
     }
+
+    return result;
 };
 
-
-const wss = new WebSocketServer({ server, path: '/terminal/ws', verifyClient: verifyClient });
+// Upgrades are authenticated manually (instead of ws `verifyClient`) so a
+// rejected browser receives a readable close code rather than an opaque 1006.
+const wss = new WebSocketServer({ noServer: true, path: '/terminal/ws' });
+server.on('upgrade', createTerminalUpgradeHandler({ wss, authenticate: verifyClient }));
 
 const HEARTBEAT_INTERVAL_MS = 30000;
 
@@ -220,7 +214,7 @@ wss.on('connection', async (ws, req) => {
     // Verify presence of required tokens
     if (!laravelSession || !xsrfToken) {
         logTerminal('warn', 'Closing websocket connection because required auth tokens are missing.', connectionContext);
-        ws.close(401, 'Unauthorized: Missing required tokens');
+        rejectTerminalSocket(ws, TERMINAL_CLOSE_CODES.AUTH_REJECTED, 'Unauthorized: Missing required tokens');
         return;
     }
 
@@ -457,16 +451,25 @@ async function handleCommand(ws, command, userId) {
     }, terminalSessionTimeout * 1000);
 }
 
+// The text message is kept for clients that predate the close code.
+function rejectTerminalToken(userSession, message) {
+    logTerminal('warn', 'Closing websocket connection because the terminal token was rejected.', {
+        userId: userSession.userId,
+        reason: message,
+    });
+    rejectTerminalSocket(userSession.ws, TERMINAL_CLOSE_CODES.TOKEN_REJECTED, message, { message });
+}
+
 async function handleTerminalToken(userSession, token) {
     if (typeof token !== 'string' || !/^[a-zA-Z0-9]{64}$/.test(token)) {
-        userSession.ws.send('Unauthorized: Invalid terminal token');
+        rejectTerminalToken(userSession, 'Unauthorized: Invalid terminal token');
         return;
     }
 
     try {
         const response = await postToCoolify('/terminal/session', userSession.authHeaders, { token });
         if (response.status !== 200 || typeof response.data?.command !== 'string') {
-            userSession.ws.send('Unauthorized: Terminal token was rejected');
+            rejectTerminalToken(userSession, 'Unauthorized: Terminal token was rejected');
             return;
         }
 
@@ -476,7 +479,7 @@ async function handleTerminalToken(userSession, token) {
             userId: userSession.userId,
             error: error.message,
         });
-        userSession.ws.send('Unauthorized: Terminal token was rejected');
+        rejectTerminalToken(userSession, 'Unauthorized: Terminal token was rejected');
     }
 }
 
diff --git a/docker/coolify-terminal/terminal-utils.js b/docker/coolify-terminal/terminal-utils.js
index cc6d6fefd0..a1207b028a 100644
--- a/docker/coolify-terminal/terminal-utils.js
+++ b/docker/coolify-terminal/terminal-utils.js
@@ -1,5 +1,126 @@
 export const MAX_TERMINAL_SESSION_TIMEOUT_SECONDS = 8 * 60 * 60;
 
+/**
+ * WebSocket close codes sent to the browser. Browsers cannot read the HTTP
+ * status of a rejected WebSocket handshake, so rejections are reported with
+ * application close codes (4000-4999) that the client can act on.
+ */
+export const TERMINAL_CLOSE_CODES = Object.freeze({
+    AUTH_REJECTED: 4401,
+    TOKEN_REJECTED: 4403,
+    AUTH_UNAVAILABLE: 1011,
+});
+
+export const TERMINAL_REJECTED_SOCKET_TERMINATE_MS = 2000;
+
+/**
+ * Authenticates a terminal WebSocket upgrade with the browser's Laravel session
+ * cookie and XSRF token. Performs the same checks as the former verifyClient
+ * callback; only the way a rejection is reported to the client differs.
+ *
+ * @param {{ laravelSession?: string, xsrfToken?: string, sessionCookieName: string }} session
+ * @param {(path: string, headers: object) => Promise<{ status: number }>} postToCoolify
+ * @returns {Promise<{ authenticated: true } | { authenticated: false, closeCode: number, reason: string, status?: number, error?: Error }>}
+ */
+export async function authenticateTerminalUpgrade({ laravelSession, xsrfToken, sessionCookieName }, postToCoolify) {
+    if (!laravelSession || !xsrfToken) {
+        return {
+            authenticated: false,
+            closeCode: TERMINAL_CLOSE_CODES.AUTH_REJECTED,
+            reason: 'Unauthorized: Missing required tokens',
+        };
+    }
+
+    try {
+        const response = await postToCoolify('/terminal/auth', {
+            'Cookie': `${sessionCookieName}=${laravelSession}`,
+            'X-XSRF-TOKEN': xsrfToken,
+        });
+
+        if (response.status === 200) {
+            return { authenticated: true };
+        }
+
+        return {
+            authenticated: false,
+            closeCode: TERMINAL_CLOSE_CODES.AUTH_REJECTED,
+            reason: 'Unauthorized: Invalid credentials',
+            status: response.status,
+        };
+    } catch (error) {
+        return {
+            authenticated: false,
+            closeCode: TERMINAL_CLOSE_CODES.AUTH_UNAVAILABLE,
+            reason: 'Internal Server Error',
+            error,
+        };
+    }
+}
+
+/**
+ * Closes a WebSocket that must not be used, optionally sending a legacy text
+ * message first for clients that predate close codes. The socket is terminated
+ * if the peer does not complete the close handshake quickly.
+ */
+export function rejectTerminalSocket(ws, closeCode, reason, { message = null, terminateAfterMs = TERMINAL_REJECTED_SOCKET_TERMINATE_MS } = {}) {
+    const terminateTimer = setTimeout(() => ws.terminate(), terminateAfterMs);
+    terminateTimer.unref?.();
+    ws.once('close', () => clearTimeout(terminateTimer));
+    // Rejected sockets have no other listeners; an unhandled 'error' (e.g. a
+    // malformed frame from an unauthenticated client) would crash the server.
+    ws.on('error', () => ws.terminate());
+
+    if (message !== null) {
+        ws.send(message);
+    }
+
+    ws.close(closeCode, reason);
+}
+
+/**
+ * Builds the HTTP `upgrade` listener for the terminal WebSocket server.
+ * Unauthenticated clients never reach the `connection` event: they are upgraded
+ * only to receive a close frame with a machine-readable code, then dropped.
+ */
+export function createTerminalUpgradeHandler({ wss, authenticate, onRejected = () => {}, terminateAfterMs = TERMINAL_REJECTED_SOCKET_TERMINATE_MS }) {
+    return (req, socket, head) => {
+        if (!wss.shouldHandle(req)) {
+            // Let ws answer unknown paths exactly as it did with the `server` option.
+            wss.handleUpgrade(req, socket, head, (ws) => ws.terminate());
+            return;
+        }
+
+        // The client may disconnect while Coolify is checking the session.
+        const destroyOnError = () => socket.destroy();
+        socket.on('error', destroyOnError);
+
+        Promise.resolve()
+            .then(() => authenticate(req))
+            .catch((error) => ({
+                authenticated: false,
+                closeCode: TERMINAL_CLOSE_CODES.AUTH_UNAVAILABLE,
+                reason: 'Internal Server Error',
+                error,
+            }))
+            .then((result) => {
+                socket.removeListener('error', destroyOnError);
+                if (socket.destroyed) {
+                    return;
+                }
+
+                wss.handleUpgrade(req, socket, head, (ws) => {
+                    if (result?.authenticated === true) {
+                        wss.emit('connection', ws, req);
+                        return;
+                    }
+
+                    onRejected(result, req);
+                    rejectTerminalSocket(ws, result.closeCode, result.reason, { terminateAfterMs });
+                });
+            });
+    };
+}
+
 const DEFAULT_TERMINAL_PATH = '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin';
 
 export function getTerminalProcessEnv(environment = process.env) {
diff --git a/docker/coolify-terminal/terminal-utils.test.js b/docker/coolify-terminal/terminal-utils.test.js
index bc2525ded8..fd6297fad4 100644
--- a/docker/coolify-terminal/terminal-utils.test.js
+++ b/docker/coolify-terminal/terminal-utils.test.js
@@ -2,12 +2,16 @@ import test from 'node:test';
 import assert from 'node:assert/strict';
 import {
     MAX_TERMINAL_SESSION_TIMEOUT_SECONDS,
+    TERMINAL_CLOSE_CODES,
+    authenticateTerminalUpgrade,
+    createTerminalUpgradeHandler,
     extractSshArgs,
     extractTargetHost,
     getTerminalProcessEnv,
     getTerminalSessionTimeout,
     isAuthorizedTargetHost,
     normalizeHostForAuthorization,
+    rejectTerminalSocket,
     sanitizeSshArgs,
     validateSshArgs,
 } from './terminal-utils.js';
@@ -180,3 +184,277 @@ test('getTerminalSessionTimeout always enforces the maximum terminal session lif
     assert.equal(getTerminalSessionTimeout(60), MAX_TERMINAL_SESSION_TIMEOUT_SECONDS);
     assert.equal(getTerminalSessionTimeout(MAX_TERMINAL_SESSION_TIMEOUT_SECONDS + 60), MAX_TERMINAL_SESSION_TIMEOUT_SECONDS);
 });
+
+function createFakeSocket() {
+    const listeners = {};
+
+    return {
+        destroyed: false,
+        on(event, listener) {
+            (listeners[event] ??= []).push(listener);
+        },
+        removeListener(event, listener) {
+            listeners[event] = (listeners[event] ?? []).filter((candidate) => candidate !== listener);
+        },
+        emit(event, ...args) {
+            (listeners[event] ?? []).forEach((listener) => listener(...args));
+        },
+        destroy() {
+            this.destroyed = true;
+        },
+        listenerCount(event) {
+            return (listeners[event] ?? []).length;
+        },
+    };
+}
+
+function createFakeWebSocket() {
+    const closeListeners = [];
+    const errorListeners = [];
+
+    return {
+        events: [],
+        terminated: false,
+        on(event, listener) {
+            if (event === 'error') {
+                errorListeners.push(listener);
+            }
+        },
+        emitError(error) {
+            if (errorListeners.length === 0) {
+                throw error;
+            }
+            errorListeners.forEach((listener) => listener(error));
+        },
+        send(message) {
+            this.events.push(['send', message]);
+        },
+        close(code, reason) {
+            this.events.push(['close', code, reason]);
+        },
+        terminate() {
+            this.terminated = true;
+        },
+        once(event, listener) {
+            if (event === 'close') {
+                closeListeners.push(listener);
+            }
+        },
+        peerClosed() {
+            closeListeners.forEach((listener) => listener());
+        },
+    };
+}
+
+function createFakeWebSocketServer({ handles = true } = {}) {
+    return {
+        connections: [],
+        upgrades: [],
+        sockets: [],
+        shouldHandle() {
+            return handles;
+        },
+        handleUpgrade(req, socket, head, callback) {
+            this.upgrades.push(req);
+            if (!handles) {
+                return;
+            }
+            const ws = createFakeWebSocket();
+            this.sockets.push(ws);
+            callback(ws);
+        },
+        emit(event, ws, req) {
+            if (event === 'connection') {
+                this.connections.push([ws, req]);
+            }
+        },
+    };
+}
+
+const flushPromises = () => new Promise((resolve) => setImmediate(resolve));
+
+test('authenticateTerminalUpgrade rejects missing session cookies with the auth close code without calling Coolify', async () => {
+    let requests = 0;
+    const postToCoolify = async () => {
+        requests++;
+        return { status: 200 };
+    };
+
+    for (const session of [
+        { sessionCookieName: 'coolify_session', laravelSession: undefined, xsrfToken: 'xsrf' },
+        { sessionCookieName: 'coolify_session', laravelSession: 'session', xsrfToken: undefined },
+    ]) {
+        assert.deepEqual(await authenticateTerminalUpgrade(session, postToCoolify), {
+            authenticated: false,
+            closeCode: TERMINAL_CLOSE_CODES.AUTH_REJECTED,
+            reason: 'Unauthorized: Missing required tokens',
+        });
+    }
+
+    assert.equal(requests, 0);
+    assert.equal(TERMINAL_CLOSE_CODES.AUTH_REJECTED, 4401);
+    assert.equal(TERMINAL_CLOSE_CODES.TOKEN_REJECTED, 4403);
+});
+
+test('authenticateTerminalUpgrade checks the Laravel session exactly like the previous verifyClient', async () => {
+    const requests = [];
+    const result = await authenticateTerminalUpgrade(
+        { sessionCookieName: 'coolify_session', laravelSession: 'session-value', xsrfToken: 'xsrf-value' },
+        async (path, headers) => {
+            requests.push([path, headers]);
+            return { status: 200 };
+        },
+    );
+
+    assert.deepEqual(result, { authenticated: true });
+    assert.deepEqual(requests, [[
+        '/terminal/auth',
+        { 'Cookie': 'coolify_session=session-value', 'X-XSRF-TOKEN': 'xsrf-value' },
+    ]]);
+});
+
+test('authenticateTerminalUpgrade rejects every non-200 Coolify response', async () => {
+    for (const status of [201, 204, 302, 401, 403, 419, 500]) {
+        const result = await authenticateTerminalUpgrade(
+            { sessionCookieName: 'coolify_session', laravelSession: 'session', xsrfToken: 'xsrf' },
+            async () => ({ status }),
+        );
+
+        assert.equal(result.authenticated, false, `status ${status} must not authenticate`);
+        assert.equal(result.closeCode, TERMINAL_CLOSE_CODES.AUTH_REJECTED);
+        assert.equal(result.reason, 'Unauthorized: Invalid credentials');
+    }
+});
+
+test('authenticateTerminalUpgrade does not authenticate when Coolify is unreachable', async () => {
+    const result = await authenticateTerminalUpgrade(
+        { sessionCookieName: 'coolify_session', laravelSession: 'session', xsrfToken: 'xsrf' },
+        async () => {
+            throw new Error('connect ECONNREFUSED');
+        },
+    );
+
+    assert.equal(result.authenticated, false);
+    assert.equal(result.closeCode, TERMINAL_CLOSE_CODES.AUTH_UNAVAILABLE);
+    assert.equal(result.error.message, 'connect ECONNREFUSED');
+});
+
+test('rejectTerminalSocket sends the legacy message before closing with a readable code', () => {
+    const ws = createFakeWebSocket();
+
+    rejectTerminalSocket(ws, TERMINAL_CLOSE_CODES.TOKEN_REJECTED, 'Unauthorized: Terminal token was rejected', {
+        message: 'Unauthorized: Terminal token was rejected',
+    });
+    ws.peerClosed();
+
+    assert.deepEqual(ws.events, [
+        ['send', 'Unauthorized: Terminal token was rejected'],
+        ['close', 4403, 'Unauthorized: Terminal token was rejected'],
+    ]);
+});
+
+test('rejectTerminalSocket terminates peers that ignore the close handshake', async () => {
+    const ws = createFakeWebSocket();
+
+    rejectTerminalSocket(ws, TERMINAL_CLOSE_CODES.AUTH_REJECTED, 'Unauthorized: Invalid credentials', { terminateAfterMs: 5 });
+    await new Promise((resolve) => setTimeout(resolve, 20));
+
+    assert.deepEqual(ws.events, [['close', 4401, 'Unauthorized: Invalid credentials']]);
+    assert.equal(ws.terminated, true);
+});
+
+test('createTerminalUpgradeHandler only emits connection for authenticated upgrades', async () => {
+    const wss = createFakeWebSocketServer();
+    const req = { url: '/terminal/ws' };
+    const handler = createTerminalUpgradeHandler({ wss, authenticate: async () => ({ authenticated: true }) });
+
+    handler(req, createFakeSocket(), Buffer.alloc(0));
+    await flushPromises();
+
+    assert.equal(wss.connections.length, 1);
+    assert.equal(wss.connections[0][1], req);
+    assert.deepEqual(wss.sockets[0].events, []);
+});
+
+test('createTerminalUpgradeHandler closes rejected upgrades with the auth close code and never emits connection', async () => {
+    const wss = createFakeWebSocketServer();
+    const rejected = [];
+    const handler = createTerminalUpgradeHandler({
+        wss,
+        authenticate: async () => ({
+            authenticated: false,
+            closeCode: TERMINAL_CLOSE_CODES.AUTH_REJECTED,
+            reason: 'Unauthorized: Invalid credentials',
+        }),
+        onRejected: (result) => rejected.push(result.closeCode),
+    });
+
+    handler({ url: '/terminal/ws' }, createFakeSocket(), Buffer.alloc(0));
+    await flushPromises();
+
+    assert.equal(wss.connections.length, 0);
+    assert.deepEqual(rejected, [4401]);
+    assert.deepEqual(wss.sockets[0].events, [['close', 4401, 'Unauthorized: Invalid credentials']]);
+});
+
+test('createTerminalUpgradeHandler treats authentication errors and malformed results as rejections', async () => {
+    for (const authenticate of [
+        async () => {
+            throw new Error('boom');
+        },
+        async () => ({ authenticated: 'yes', closeCode: TERMINAL_CLOSE_CODES.AUTH_REJECTED, reason: 'Unauthorized' }),
+    ]) {
+        const wss = createFakeWebSocketServer();
+        createTerminalUpgradeHandler({ wss, authenticate })({ url: '/terminal/ws' }, createFakeSocket(), Buffer.alloc(0));
+        await flushPromises();
+
+        assert.equal(wss.connections.length, 0);
+        assert.equal(wss.sockets[0].events[0][0], 'close');
+        assert.notEqual(wss.sockets[0].events[0][1], 1000);
+    }
+});
+
+test('createTerminalUpgradeHandler does not authenticate requests for other paths', async () => {
+    const wss = createFakeWebSocketServer({ handles: false });
+    let authenticated = 0;
+
+    createTerminalUpgradeHandler({ wss, authenticate: async () => ++authenticated })({ url: '/other' }, createFakeSocket(), Buffer.alloc(0));
+    await flushPromises();
+
+    assert.equal(authenticated, 0);
+    assert.equal(wss.upgrades.length, 1);
+    assert.equal(wss.connections.length, 0);
+});
+
+test('createTerminalUpgradeHandler drops sockets that disconnect while authentication is pending', async () => {
+    const wss = createFakeWebSocketServer();
+    const socket = createFakeSocket();
+    let finishAuthentication;
+
+    createTerminalUpgradeHandler({
+        wss,
+        authenticate: () => new Promise((resolve) => {
+            finishAuthentication = resolve;
+        }),
+    })({ url: '/terminal/ws' }, socket, Buffer.alloc(0));
+
+    socket.emit('error', new Error('ECONNRESET'));
+    await flushPromises();
+    finishAuthentication({ authenticated: true });
+    await flushPromises();
+
+    assert.equal(socket.destroyed, true);
+    assert.equal(socket.listenerCount('error'), 0);
+    assert.equal(wss.upgrades.length, 0);
+    assert.equal(wss.connections.length, 0);
+});
+
+test('rejectTerminalSocket handles socket errors so unauthenticated clients cannot crash the server', () => {
+    const ws = createFakeWebSocket();
+
+    rejectTerminalSocket(ws, TERMINAL_CLOSE_CODES.AUTH_REJECTED, 'Unauthorized: Invalid credentials');
+
+    assert.doesNotThrow(() => ws.emitError(new Error('Invalid WebSocket frame: RSV1 must be clear')));
+    assert.equal(ws.terminated, true);
+    ws.peerClosed();
+});
diff --git a/resources/js/terminal-connection.js b/resources/js/terminal-connection.js
new file mode 100644
index 0000000000..f2f463f94a
--- /dev/null
+++ b/resources/js/terminal-connection.js
@@ -0,0 +1,163 @@
+/**
+ * Close codes sent by the terminal WebSocket server (docker/coolify-terminal).
+ * 4401: the browser session was rejected; 4403: the terminal token was rejected.
+ */
+export const TERMINAL_CLOSE_CODES = Object.freeze({
+    NORMAL: 1000,
+    AUTH_REJECTED: 4401,
+    TOKEN_REJECTED: 4403,
+});
+
+/** Maximum time to wait for the WebSocket to open on the first attempt. */
+export const TERMINAL_CONNECT_TIMEOUT_MS = 15000;
+
+/** Maximum time to wait for the server's `pty-ready` after a session was requested. */
+export const TERMINAL_SESSION_START_TIMEOUT_MS = 20000;
+
+export const TERMINAL_CONNECTION_ERRORS = Object.freeze({
+    authRejected: 'Terminal access was rejected. Reload the page and try again.',
+    connectionFailed: 'Could not connect to the terminal server. Reload the page and try again.',
+    timeout: 'Timed out while connecting to the terminal. Reload the page and try again.',
+});
+
+const AUTH_REJECTION_MESSAGES = new Set([
+    'Unauthorized: Missing required tokens',
+    'Unauthorized: Invalid terminal token',
+    'Unauthorized: Terminal token was rejected',
+]);
+
+export function isTerminalAuthRejectionCode(code) {
+    return code === TERMINAL_CLOSE_CODES.AUTH_REJECTED || code === TERMINAL_CLOSE_CODES.TOKEN_REJECTED;
+}
+
+/**
+ * Classifies a plain-text message from the terminal server.
+ *
+ * @returns {'auth-rejected'|'startup-rejected'|null}
+ */
+export function classifyTerminalServerMessage(data) {
+    if (typeof data !== 'string') {
+        return null;
+    }
+
+    if (AUTH_REJECTION_MESSAGES.has(data)) {
+        return 'auth-rejected';
+    }
+
+    if (data.startsWith('Unauthorized:') || data.startsWith('Invalid SSH command:')) {
+        return 'startup-rejected';
+    }
+
+    return null;
+}
+
+/**
+ * Decides how the terminal reacts to a WebSocket close event.
+ *
+ * - Auth rejections never reconnect: a new socket would be rejected again.
+ * - A clean close (1000) is intentional and needs no action.
+ * - Any other close reconnects with backoff until the attempt limit, and
+ *   reports an error when a session was waiting to start or retries ran out.
+ *
+ * @param {{ code: number, sessionPending: boolean, reconnectAttempts: number, maxReconnectAttempts: number }} state
+ * @returns {{ authRejected: boolean, reconnect: boolean, error: string|null }}
+ */
+export function resolveTerminalCloseOutcome({ code, sessionPending, reconnectAttempts, maxReconnectAttempts }) {
+    if (isTerminalAuthRejectionCode(code)) {
+        return { authRejected: true, reconnect: false, error: TERMINAL_CONNECTION_ERRORS.authRejected };
+    }
+
+    if (code === TERMINAL_CLOSE_CODES.NORMAL) {
+        return { authRejected: false, reconnect: false, error: null };
+    }
+
+    const reconnect = reconnectAttempts < maxReconnectAttempts;
+
+    return {
+        authRejected: false,
+        reconnect,
+        error: sessionPending || !reconnect ? TERMINAL_CONNECTION_ERRORS.connectionFailed : null,
+    };
+}
+
+/**
+ * Session-start state for the terminal Alpine component (`terminalData()` spreads it in).
+ *
+ * The host provides `starting`, `terminalActive`, `connectionError`, `authRejected`,
+ * `pendingCommand`, `sessionStartTimeoutId`, `$wire`, and `ensureWebSocketConnection()`.
+ * Only one session-start timer exists at a time: every start clears the previous timer.
+ */
+export const terminalSessionStartMethods = {
+    /** A session was requested and the UI shows "connecting…" until `pty-ready`. */
+    isTerminalSessionPending() {
+        return this.starting && !this.terminalActive;
+    },
+
+    /**
+     * Leave the "connecting" state and show why. The first reason wins unless
+     * `override` is set (auth rejections replace generic connection errors).
+     */
+    failTerminalConnection(message, { override = false } = {}) {
+        this.starting = false;
+        this.clearSessionStartTimeout();
+
+        if (this.connectionError === message || (this.connectionError && !override)) {
+            return;
+        }
+
+        this.connectionError = message;
+        this.$wire.dispatch('error', message);
+    },
+
+    /** Called whenever a new terminal session is requested (target chosen or token issued). */
+    beginTerminalSessionStart() {
+        this.starting = true;
+        this.connectionError = null;
+        this.authRejected = false;
+        this.armTerminalSessionStartTimeout();
+        this.ensureWebSocketConnection();
+    },
+
+    /** Show the timeout error if no session is ready in time. Replaces an earlier timer. */
+    armTerminalSessionStartTimeout() {
+        this.clearSessionStartTimeout();
+        this.sessionStartTimeoutId = setTimeout(() => {
+            this.sessionStartTimeoutId = null;
+            if (this.isTerminalSessionPending()) {
+                // Single-use tokens must not be sent after the user was told to retry.
+                this.pendingCommand = null;
+                this.failTerminalConnection(TERMINAL_CONNECTION_ERRORS.timeout);
+            }
+        }, TERMINAL_SESSION_START_TIMEOUT_MS);
+    },
+
+    clearSessionStartTimeout() {
+        if (this.sessionStartTimeoutId) {
+            clearTimeout(this.sessionStartTimeoutId);
+            this.sessionStartTimeoutId = null;
+        }
+    },
+
+    /** The server reported `pty-ready`. */
+    completeTerminalSessionStart() {
+        this.starting = false;
+        this.connectionError = null;
+        this.clearSessionStartTimeout();
+    },
+
+    /** Coolify refused to issue a terminal token (`terminal-session-failed`). */
+    failTerminalSessionStart(message) {
+        this.pendingCommand = null;
+        this.failTerminalConnection(message || TERMINAL_CONNECTION_ERRORS.connectionFailed, { override: true });
+    },
+
+    /** No container was auto-selected (`terminal-auto-start-cancelled`); wait for the user. */
+    cancelTerminalAutoStart() {
+        if (this.terminalActive || this.pendingCommand) {
+            return;
+        }
+
+        this.starting = false;
+        this.clearSessionStartTimeout();
+    },
+};
diff --git a/resources/js/terminal-connection.test.js b/resources/js/terminal-connection.test.js
new file mode 100644
index 0000000000..2f0827283f
--- /dev/null
+++ b/resources/js/terminal-connection.test.js
@@ -0,0 +1,89 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {
+    TERMINAL_CLOSE_CODES,
+    TERMINAL_CONNECT_TIMEOUT_MS,
+    TERMINAL_CONNECTION_ERRORS,
+    TERMINAL_SESSION_START_TIMEOUT_MS,
+    classifyTerminalServerMessage,
+    isTerminalAuthRejectionCode,
+    resolveTerminalCloseOutcome,
+} from './terminal-connection.js';
+
+const closeOutcome = (overrides = {}) => resolveTerminalCloseOutcome({
+    code: 1006,
+    sessionPending: false,
+    reconnectAttempts: 0,
+    maxReconnectAttempts: 10,
+    ...overrides,
+});
+
+test('terminal close codes match the codes sent by the terminal server', () => {
+    assert.equal(TERMINAL_CLOSE_CODES.AUTH_REJECTED, 4401);
+    assert.equal(TERMINAL_CLOSE_CODES.TOKEN_REJECTED, 4403);
+    assert.equal(isTerminalAuthRejectionCode(4401), true);
+    assert.equal(isTerminalAuthRejectionCode(4403), true);
+    assert.equal(isTerminalAuthRejectionCode(1006), false);
+    assert.equal(isTerminalAuthRejectionCode(4000), false);
+});
+
+test('auth rejection closes stop reconnecting and show the reload message', () => {
+    for (const code of [4401, 4403]) {
+        for (const sessionPending of [true, false]) {
+            assert.deepEqual(closeOutcome({ code, sessionPending }), {
+                authRejected: true,
+                reconnect: false,
+                error: 'Terminal access was rejected. Reload the page and try again.',
+            });
+        }
+    }
+});
+
+test('a clean close neither reconnects nor reports an error', () => {
+    assert.deepEqual(closeOutcome({ code: 1000, sessionPending: true }), {
+        authRejected: false,
+        reconnect: false,
+        error: null,
+    });
+});
+
+test('a close before the session is ready leaves the connecting state with a generic error', () => {
+    for (const code of [1006, 1011, 1001, 4000]) {
+        assert.deepEqual(closeOutcome({ code, sessionPending: true }), {
+            authRejected: false,
+            reconnect: true,
+            error: TERMINAL_CONNECTION_ERRORS.connectionFailed,
+        });
+    }
+});
+
+test('an idle close reconnects silently until the retry limit, then reports an error', () => {
+    assert.deepEqual(closeOutcome({ reconnectAttempts: 9 }), {
+        authRejected: false,
+        reconnect: true,
+        error: null,
+    });
+    assert.deepEqual(closeOutcome({ reconnectAttempts: 10 }), {
+        authRejected: false,
+        reconnect: false,
+        error: TERMINAL_CONNECTION_ERRORS.connectionFailed,
+    });
+});
+
+test('server text messages are classified for backward compatible rejection handling', () => {
+    assert.equal(classifyTerminalServerMessage('Unauthorized: Invalid terminal token'), 'auth-rejected');
+    assert.equal(classifyTerminalServerMessage('Unauthorized: Terminal token was rejected'), 'auth-rejected');
+    assert.equal(classifyTerminalServerMessage('Unauthorized: Missing required tokens'), 'auth-rejected');
+    assert.equal(classifyTerminalServerMessage('Unauthorized: Target host 10.0.0.5 not in authorized list'), 'startup-rejected');
+    assert.equal(classifyTerminalServerMessage('Invalid SSH command: No target host found'), 'startup-rejected');
+    assert.equal(classifyTerminalServerMessage('pty-ready'), null);
+    assert.equal(classifyTerminalServerMessage('root@host:~# '), null);
+    assert.equal(classifyTerminalServerMessage(new Blob([])), null);
+});
+
+test('connection timeouts stay within a bounded window', () => {
+    assert.equal(TERMINAL_CONNECT_TIMEOUT_MS, 15000);
+    assert.ok(TERMINAL_SESSION_START_TIMEOUT_MS >= TERMINAL_CONNECT_TIMEOUT_MS);
+    assert.ok(TERMINAL_SESSION_START_TIMEOUT_MS <= 30000);
+    assert.equal(TERMINAL_CONNECTION_ERRORS.timeout, 'Timed out while connecting to the terminal. Reload the page and try again.');
+});
diff --git a/resources/js/terminal-session-start.test.js b/resources/js/terminal-session-start.test.js
new file mode 100644
index 0000000000..1f1181803b
--- /dev/null
+++ b/resources/js/terminal-session-start.test.js
@@ -0,0 +1,179 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {
+    TERMINAL_CONNECTION_ERRORS,
+    TERMINAL_SESSION_START_TIMEOUT_MS,
+    terminalSessionStartMethods,
+} from './terminal-connection.js';
+
+/**
+ * Builds the smallest host that the terminal Alpine component gives to the mixin.
+ */
+function createTerminalHost(overrides = {}) {
+    const host = {
+        starting: false,
+        terminalActive: false,
+        connectionError: null,
+        authRejected: false,
+        pendingCommand: null,
+        sessionStartTimeoutId: null,
+        toasts: [],
+        websocketStarts: 0,
+        $wire: {
+            dispatch(name, message) {
+                host.toasts.push([name, message]);
+            },
+        },
+        ensureWebSocketConnection() {
+            host.websocketStarts++;
+        },
+        ...terminalSessionStartMethods,
+        ...overrides,
+    };
+
+    return host;
+}
+
+/** Same steps as `init()` in terminal.js for `data-auto-start="true"`. */
+function autoStart(host) {
+    host.starting = true;
+    host.armTerminalSessionStartTimeout();
+}
+
+test('auto-start without a token leaves connecting and shows the timeout error', (t) => {
+    t.mock.timers.enable({ apis: ['setTimeout'] });
+    const host = createTerminalHost();
+
+    autoStart(host);
+    t.mock.timers.tick(TERMINAL_SESSION_START_TIMEOUT_MS - 1);
+
+    assert.equal(host.starting, true);
+    assert.equal(host.connectionError, null);
+
+    t.mock.timers.tick(1);
+
+    assert.equal(host.starting, false);
+    assert.equal(host.connectionError, TERMINAL_CONNECTION_ERRORS.timeout);
+    assert.equal(host.sessionStartTimeoutId, null);
+    assert.deepEqual(host.toasts, [['error', TERMINAL_CONNECTION_ERRORS.timeout]]);
+});
+
+test('a token after auto-start replaces the timer and pty-ready clears it', (t) => {
+    t.mock.timers.enable({ apis: ['setTimeout'] });
+    const host = createTerminalHost();
+
+    autoStart(host);
+    t.mock.timers.tick(TERMINAL_SESSION_START_TIMEOUT_MS - 1000);
+
+    // send-terminal-token
+    host.beginTerminalSessionStart();
+    assert.equal(host.websocketStarts, 1);
+
+    // The auto-start timer was replaced, so its deadline passes without an error.
+    t.mock.timers.tick(2000);
+    assert.equal(host.starting, true);
+    assert.equal(host.connectionError, null);
+
+    // pty-ready
+    host.terminalActive = true;
+    host.completeTerminalSessionStart();
+    t.mock.timers.tick(TERMINAL_SESSION_START_TIMEOUT_MS * 2);
+
+    assert.equal(host.starting, false);
+    assert.equal(host.connectionError, null);
+    assert.equal(host.sessionStartTimeoutId, null);
+    assert.deepEqual(host.toasts, []);
+});
+
+test('a token that arrives after the timeout error still starts the session', (t) => {
+    t.mock.timers.enable({ apis: ['setTimeout'] });
+    const host = createTerminalHost();
+
+    autoStart(host);
+    t.mock.timers.tick(TERMINAL_SESSION_START_TIMEOUT_MS);
+    assert.equal(host.connectionError, TERMINAL_CONNECTION_ERRORS.timeout);
+
+    host.beginTerminalSessionStart();
+
+    assert.equal(host.starting, true);
+    assert.equal(host.connectionError, null);
+
+    host.terminalActive = true;
+    host.completeTerminalSessionStart();
+
+    assert.equal(host.starting, false);
+    assert.equal(host.sessionStartTimeoutId, null);
+});
+
+test('arming the timer twice keeps one timer only', (t) => {
+    t.mock.timers.enable({ apis: ['setTimeout'] });
+    const host = createTerminalHost();
+
+    autoStart(host);
+    host.armTerminalSessionStartTimeout();
+    // Teardown must clear the only timer; an orphaned first timer would still fire.
+    host.clearSessionStartTimeout();
+    t.mock.timers.tick(TERMINAL_SESSION_START_TIMEOUT_MS * 2);
+
+    assert.equal(host.starting, true);
+    assert.equal(host.connectionError, null);
+    assert.deepEqual(host.toasts, []);
+});
+
+test('a server-side start failure stops the spinner at once with its message', (t) => {
+    t.mock.timers.enable({ apis: ['setTimeout'] });
+    const host = createTerminalHost({ pendingCommand: { terminalToken: 'stale' } });
+
+    autoStart(host);
+    host.failTerminalSessionStart('The container is not running.');
+
+    assert.equal(host.starting, false);
+    assert.equal(host.connectionError, 'The container is not running.');
+    assert.equal(host.pendingCommand, null);
+    assert.equal(host.sessionStartTimeoutId, null);
+
+    t.mock.timers.tick(TERMINAL_SESSION_START_TIMEOUT_MS);
+
+    assert.deepEqual(host.toasts, [['error', 'The container is not running.']]);
+});
+
+test('a server-side start failure replaces an earlier timeout error', () => {
+    const host = createTerminalHost({ connectionError: TERMINAL_CONNECTION_ERRORS.timeout });
+
+    host.failTerminalSessionStart('No shell is available in this container.');
+
+    assert.equal(host.connectionError, 'No shell is available in this container.');
+});
+
+test('a server-side start failure without a message falls back to the generic error', () => {
+    const host = createTerminalHost();
+
+    host.failTerminalSessionStart(undefined);
+
+    assert.equal(host.connectionError, TERMINAL_CONNECTION_ERRORS.connectionFailed);
+});
+
+test('a cancelled auto-start waits for a container choice without an error', (t) => {
+    t.mock.timers.enable({ apis: ['setTimeout'] });
+    const host = createTerminalHost();
+
+    autoStart(host);
+    host.cancelTerminalAutoStart();
+    t.mock.timers.tick(TERMINAL_SESSION_START_TIMEOUT_MS * 2);
+
+    assert.equal(host.starting, false);
+    assert.equal(host.connectionError, null);
+    assert.equal(host.sessionStartTimeoutId, null);
+    assert.deepEqual(host.toasts, []);
+});
+
+test('a cancelled auto-start does not stop a session that is already starting', (t) => {
+    t.mock.timers.enable({ apis: ['setTimeout'] });
+    const host = createTerminalHost({ pendingCommand: { terminalToken: 'token' } });
+
+    autoStart(host);
+    host.cancelTerminalAutoStart();
+
+    assert.equal(host.starting, true);
+    assert.notEqual(host.sessionStartTimeoutId, null);
+});
diff --git a/resources/js/terminal.js b/resources/js/terminal.js
index e643a72510..420e20fb11 100644
--- a/resources/js/terminal.js
+++ b/resources/js/terminal.js
@@ -6,6 +6,13 @@ import {
     TERMINAL_SESSION_WARNING_SECONDS,
     formatTerminalSessionRemainingTime,
 } from './terminal-session-timer.js';
+import {
+    TERMINAL_CONNECT_TIMEOUT_MS,
+    TERMINAL_CONNECTION_ERRORS,
+    classifyTerminalServerMessage,
+    resolveTerminalCloseOutcome,
+    terminalSessionStartMethods,
+} from './terminal-connection.js';
 import { FitAddon } from '@xterm/addon-fit';
 
 const terminalDebugParameter = new URLSearchParams(window.location.search).get('terminal-debug');
@@ -178,6 +185,11 @@ export function initializeTerminalComponent() {
             maxReconnectDelay: 30000,
             connectionTimeout: 10000,
             connectionTimeoutId: null,
+            // Shown instead of "connecting…" once a connection or session start failed.
+            connectionError: null,
+            // Set when the server rejected authentication; disables automatic reconnects.
+            authRejected: false,
+            sessionStartTimeoutId: null,
             lastPingTime: null,
             pingTimeout: 35000, // 5 seconds longer than ping interval
             pingTimeoutId: null,
@@ -214,8 +226,15 @@ export function initializeTerminalComponent() {
                 ? localStorage.getItem('coolify-console-theme')
                 : 'system',
 
+            ...terminalSessionStartMethods,
+
             init() {
                 this.starting = this.$el.dataset.autoStart === 'true';
+                // Auto-start requests a token without a user action. If no token or error
+                // arrives, the session-start timeout ends "connecting…" with an error.
+                if (this.starting) {
+                    this.armTerminalSessionStartTimeout();
+                }
                 this.updateKeyboardInset = () => {
                     const viewport = window.visualViewport;
                     const viewportWidth = viewport?.width ?? window.innerWidth;
@@ -287,9 +306,26 @@ export function initializeTerminalComponent() {
                 this.setupTerminalEventListeners();
 
                 this.$wire.on('send-terminal-token', ([token]) => {
+                    // A token requested before the rejection arrived must not reconnect;
+                    // only a user-initiated start (terminal-starting) retries.
+                    if (this.authRejected) {
+                        logTerminal('warn', '[Terminal] Ignoring terminal token after authentication was rejected.');
+                        return;
+                    }
+                    this.beginTerminalSessionStart();
                     this.sendCommandWhenReady({ terminalToken: token });
                 });
 
+                // Coolify did not issue a token (container stopped, no shell, access denied).
+                this.$wire.on('terminal-session-failed', ({ message }) => {
+                    this.failTerminalSessionStart(message);
+                });
+
+                // The page shows a container picker; nothing starts until the user chooses.
+                this.$wire.on('terminal-auto-start-cancelled', () => {
+                    this.cancelTerminalAutoStart();
+                });
+
                 this.$wire.on('terminal-should-focus', () => {
                     // Wait for terminal to be ready, then focus
                     const focusWhenReady = () => {
@@ -365,6 +401,7 @@ export function initializeTerminalComponent() {
                 clearTimeout(this.keyboardInsetSettleTimeout);
                 this.checkIfProcessIsRunningAndKillIt();
                 this.clearAllTimers();
+                this.clearSessionStartTimeout();
                 this.connectionState = 'disconnected';
                 this.pendingCommand = null;
                 this.resetTerminalSessionCountdown();
@@ -621,12 +658,15 @@ export function initializeTerminalComponent() {
                     this.socket = new WebSocket(url);
 
                     // Set connection timeout - increased for initial connection
-                    const timeoutMs = this.reconnectAttempts === 0 ? 15000 : this.connectionTimeout;
+                    const timeoutMs = this.reconnectAttempts === 0 ? TERMINAL_CONNECT_TIMEOUT_MS : this.connectionTimeout;
                     this.connectionTimeoutId = setTimeout(() => {
                         if (this.connectionState === 'connecting') {
                             logTerminal('error', `[Terminal] Connection timeout after ${timeoutMs}ms`);
+                            if (this.isTerminalSessionPending()) {
+                                this.failTerminalConnection(TERMINAL_CONNECTION_ERRORS.timeout);
+                            }
+                            // The resulting close event schedules the (bounded) reconnect.
                             this.socket.close();
-                            this.handleConnectionError('Connection timeout');
                         }
                     }, timeoutMs);
 
@@ -659,6 +699,8 @@ export function initializeTerminalComponent() {
                 if (this.pendingCommand) {
                     this.sendMessage(this.pendingCommand);
                     this.pendingCommand = null;
+                    this.connectionError = null;
+                    this.starting = true;
                 }
 
                 // (Re)start application-level keepalive on every successful connect.
@@ -679,7 +721,11 @@ export function initializeTerminalComponent() {
                 logTerminal('error', '[Terminal] WebSocket error:', error);
                 logTerminal('error', '[Terminal] WebSocket state:', this.socket ? this.socket.readyState : 'No socket');
                 logTerminal('error', '[Terminal] Connection attempt:', this.reconnectAttempts + 1);
-                this.handleConnectionError('WebSocket error occurred');
+                // Browsers always follow an error event with a close event, which
+                // schedules the reconnect. Only surface the failure here.
+                if (this.isTerminalSessionPending()) {
+                    this.failTerminalConnection(TERMINAL_CONNECTION_ERRORS.connectionFailed);
+                }
             },
 
             handleSocketClose(event) {
@@ -687,10 +733,31 @@ export function initializeTerminalComponent() {
                 logTerminal('log', '[Terminal] Was clean close:', event.code === 1000);
                 logTerminal('log', '[Terminal] Connection attempt:', this.reconnectAttempts + 1);
 
+                const outcome = resolveTerminalCloseOutcome({
+                    code: event.code,
+                    sessionPending: this.isTerminalSessionPending(),
+                    reconnectAttempts: this.reconnectAttempts,
+                    maxReconnectAttempts: this.maxReconnectAttempts,
+                });
+
                 this.connectionState = 'disconnected';
                 this.clearAllTimers();
                 this.resetTerminalSessionCountdown();
 
+                if (outcome.authRejected) {
+                    // Reconnecting would be rejected again; wait for a reload or a new session request.
+                    logTerminal('error', '[Terminal] Server rejected terminal authentication:', event.reason);
+                    this.authRejected = true;
+                    this.pendingCommand = null;
+                    if (this.terminalActive) {
+                        this.exitFullscreen();
+                        this.terminalActive = false;
+                        this.$wire.dispatch('terminalDisconnected');
+                    }
+                    this.failTerminalConnection(outcome.error, { override: true });
+                    return;
+                }
+
                 // Only reset terminal and reconnect if it wasn't a clean close
                 if (event.code !== 1000) {
                     // Don't show terminal reset message on first connection attempt
@@ -699,6 +766,9 @@ export function initializeTerminalComponent() {
                         this.message = '(connection closed)';
                         this.terminalActive = false;
                     }
+                    if (outcome.error) {
+                        this.failTerminalConnection(outcome.error);
+                    }
                     this.scheduleReconnect();
                 }
             },
@@ -707,21 +777,47 @@ export function initializeTerminalComponent() {
                 logTerminal('error', `[Terminal] Connection error: ${reason} (attempt ${this.reconnectAttempts + 1})`);
                 this.connectionState = 'disconnected';
 
-                // Only dispatch error to UI after a few failed attempts to avoid immediate error on page load
-                if (this.reconnectAttempts >= 2) {
-                    this.$wire.dispatch('error', `Terminal connection error: ${reason}`);
+                if (this.isTerminalSessionPending() || this.reconnectAttempts >= 2) {
+                    this.failTerminalConnection(TERMINAL_CONNECTION_ERRORS.connectionFailed);
                 }
 
                 this.scheduleReconnect();
             },
 
+            /** Reconnect immediately for a user-requested session if the socket is closed. */
+            ensureWebSocketConnection() {
+                if (this.socket && this.socket.readyState !== WebSocket.CLOSED) {
+                    return;
+                }
+
+                if (this.reconnectInterval) {
+                    clearTimeout(this.reconnectInterval);
+                    this.reconnectInterval = null;
+                }
+                this.reconnectAttempts = 0;
+                this.initializeWebSocket();
+            },
+
+            reloadTerminalPage() {
+                window.location.reload();
+            },
+
             scheduleReconnect() {
+                if (this.authRejected) {
+                    return;
+                }
+
                 if (this.reconnectAttempts >= this.maxReconnectAttempts) {
                     logTerminal('error', '[Terminal] Max reconnection attempts reached');
                     this.message = '(connection failed - max retries exceeded)';
+                    this.failTerminalConnection(TERMINAL_CONNECTION_ERRORS.connectionFailed);
                     return;
                 }
 
+                if (this.reconnectInterval) {
+                    return; // A reconnect is already scheduled.
+                }
+
                 this.connectionState = 'reconnecting';
 
                 // Exponential backoff with jitter
@@ -733,6 +829,7 @@ export function initializeTerminalComponent() {
                 logTerminal('warn', `[Terminal] Scheduling reconnect attempt ${this.reconnectAttempts + 1} in ${delay}ms`);
 
                 this.reconnectInterval = setTimeout(() => {
+                    this.reconnectInterval = null;
                     this.reconnectAttempts++;
                     this.initializeWebSocket();
                 }, delay);
@@ -768,7 +865,7 @@ export function initializeTerminalComponent() {
                 }
 
                 if (event.data === 'pty-ready') {
-                    this.starting = false;
+                    this.completeTerminalSessionStart();
                     if (!this.term._initialized) {
                         this.term.open(document.getElementById('terminal'));
                         this.term._initialized = true;
@@ -809,6 +906,7 @@ export function initializeTerminalComponent() {
                     this.$wire.dispatch('terminalConnected');
                 } else if (event.data === 'unprocessable') {
                     this.starting = false;
+                    this.clearSessionStartTimeout();
                     if (this.term) this.term.reset();
                     this.terminalActive = false;
                     this.resetTerminalSessionCountdown();
@@ -827,14 +925,18 @@ export function initializeTerminalComponent() {
 
                     // Notify parent component that terminal disconnected
                     this.$wire.dispatch('terminalDisconnected');
-                } else if (
-                    typeof event.data === 'string' &&
-                    (event.data.startsWith('Unauthorized:') || event.data.startsWith('Invalid SSH command:'))
-                ) {
+                } else if (classifyTerminalServerMessage(event.data) !== null) {
                     logTerminal('error', '[Terminal] Backend rejected terminal startup:', event.data);
-                    this.$wire.dispatch('error', event.data);
+                    this.pendingCommand = null;
                     this.terminalActive = false;
                     this.resetTerminalSessionCountdown();
+                    // Newer servers follow an auth rejection with a 4401/4403 close.
+                    this.failTerminalConnection(
+                        classifyTerminalServerMessage(event.data) === 'auth-rejected'
+                            ? TERMINAL_CONNECTION_ERRORS.authRejected
+                            : event.data,
+                        { override: true },
+                    );
                 } else {
                     try {
                         this.pendingWrites++;
@@ -896,6 +998,7 @@ export function initializeTerminalComponent() {
             },
 
             destroy() {
+                this.clearSessionStartTimeout();
                 this.themeObserver?.disconnect();
                 window.visualViewport?.removeEventListener('resize', this.syncKeyboardInset);
                 window.visualViewport?.removeEventListener('scroll', this.syncKeyboardInset);
@@ -985,7 +1088,7 @@ export function initializeTerminalComponent() {
             keepAlive() {
                 if (this.socket && this.socket.readyState === WebSocket.OPEN) {
                     this.sendMessage({ ping: true });
-                } else if (this.connectionState === 'disconnected') {
+                } else if (this.connectionState === 'disconnected' && !this.authRejected) {
                     // Attempt to reconnect if we're disconnected
                     this.initializeWebSocket();
                 }
@@ -1025,7 +1128,7 @@ export function initializeTerminalComponent() {
                                 // ignore — close handler will run on its own
                             }
                         }, 5000);
-                    } else if (this.wasConnectedBeforeHidden && this.connectionState !== 'connected') {
+                    } else if (this.wasConnectedBeforeHidden && this.connectionState !== 'connected' && !this.authRejected) {
                         // Was connected before but now disconnected - attempt reconnection
                         this.reconnectAttempts = 0;
                         this.initializeWebSocket();
diff --git a/resources/views/components/danger-zone.blade.php b/resources/views/components/danger-zone.blade.php
index cd2f75fbce..37dc97c807 100644
--- a/resources/views/components/danger-zone.blade.php
+++ b/resources/views/components/danger-zone.blade.php
@@ -1,9 +1,17 @@
 @props(['title'])
 
-<div {{ $attributes->class('flex flex-col gap-4 sm:flex-row sm:items-center sm:justify-between') }}>
+<div
+    {{ $attributes->class('flex flex-col gap-4 rounded-lg border border-red-200 bg-red-50 p-5 sm:flex-row sm:items-start sm:justify-between dark:border-red-500/25 dark:bg-red-500/[0.08]') }}>
     <div class="min-w-0">
-        <h4 class="text-sm font-semibold text-red-700 dark:text-red-300">{{ $title }}</h4>
-        <div class="mt-2 max-w-2xl space-y-2 text-[13px] leading-5 text-red-700/80 dark:text-red-300/80">
+        <div class="flex flex-wrap items-center gap-2">
+            <h4 class="text-sm font-semibold text-black dark:text-fg">{{ $title }}</h4>
+            <span
+                class="inline-flex items-center gap-1.5 rounded-full border border-neutral-200 bg-white px-2.5 py-0.5 text-xs font-medium text-neutral-700 dark:border-white/[0.08] dark:bg-white/[0.06] dark:text-fg">
+                <span class="size-1.5 rounded-full bg-red-500"></span>
+                Permanent
+            </span>
+        </div>
+        <div class="mt-2 max-w-2xl space-y-2 text-[13px] leading-5 text-neutral-600 dark:text-fg-dim">
             {{ $slot }}
         </div>
     </div>
diff --git a/resources/views/components/proxy-configuration-warning.blade.php b/resources/views/components/proxy-configuration-warning.blade.php
index 51f4282944..5deb10dc21 100644
--- a/resources/views/components/proxy-configuration-warning.blade.php
+++ b/resources/views/components/proxy-configuration-warning.blade.php
@@ -17,19 +17,16 @@
             </span>
             <div class="min-w-0 flex-1">
                 <p class="text-[13px] leading-4 font-semibold text-neutral-950 dark:text-fg">
-                    The saved proxy configuration has not been applied
-                </p>
-                <p class="mt-0.5 text-[11px] leading-4 text-neutral-600 dark:text-fg-dim">
-                    Restart the proxy to apply these changes.
-                    @if ($canRestart)
-                        <button type="button"
-                            class="ml-0.5 inline-flex items-center gap-0.5 font-semibold text-coollabs transition-colors hover:text-coollabs-100 dark:text-warning dark:hover:text-warning/80"
-                            @click="open = false; document.getElementById('server-mobile-restart-proxy-trigger')?.click()">
-                            Restart proxy
-                            <x-reicon name="arrow-right" class="size-2.5" />
-                        </button>
-                    @endif
+                    Your configuration changed, please restart the proxy.
                 </p>
+                @if ($canRestart)
+                    <button type="button"
+                        class="mt-0.5 inline-flex items-center gap-0.5 text-[11px] leading-4 font-semibold text-coollabs transition-colors hover:text-coollabs-100 dark:text-warning dark:hover:text-warning/80"
+                        @click="open = false; document.getElementById('server-mobile-restart-proxy-trigger')?.click()">
+                        Restart proxy
+                        <x-reicon name="arrow-right" class="size-2.5" />
+                    </button>
+                @endif
             </div>
         </div>
     </div>
diff --git a/resources/views/components/server/sidebar.blade.php b/resources/views/components/server/sidebar.blade.php
index 65fe3cabbc..3645dd2a27 100644
--- a/resources/views/components/server/sidebar.blade.php
+++ b/resources/views/components/server/sidebar.blade.php
@@ -3,6 +3,7 @@
 @php
     $serverRouteParameters = ['server_uuid' => $server->uuid];
     $sentinelStatus = $server->sentinelStatus();
+    $proxyNotRunning = $server->proxySet() && ($server->proxy->status ?? 'unknown') !== 'running';
     $sentinelStatusStartedAt = $server->sentinel_waiting_since ?? \Illuminate\Support\Carbon::parse($server->sentinel_updated_at);
     $sentinelTimeoutSeconds = $server->sentinel_waiting_since !== null
         ? $server->firstSentinelReportTimeoutSeconds()
@@ -199,6 +200,7 @@
     x-data="{
         proxyConfigurationPending: @js($server->hasPendingProxyConfiguration()),
         traefikOutdated: @js($server->hasCurrentTraefikOutdatedInfo()),
+        proxyNotRunning: @js($proxyNotRunning),
         sentinelOutOfSync: @js($server->isSentinelEnabled() && $sentinelStatus === 'out_of_sync'),
         sentinelExpiryTimer: null,
         scheduleSentinelExpiry(delay) {
@@ -212,6 +214,7 @@
     @proxy-configuration-state-changed.window="
         proxyConfigurationPending = $event.detail.pending;
         traefikOutdated = $event.detail.traefikOutdated;
+        proxyNotRunning = $event.detail.proxyNotRunning;
     "
     @sentinel-status-changed.window="
         sentinelOutOfSync = $event.detail.outOfSync;
@@ -247,7 +250,7 @@
                     <span class="menu-item-label">{{ $menuItem['label'] }}</span>
                     @if ($menuItem['tracks_proxy_configuration'] ?? false)
                         <x-reicon name="alert-triangle" x-cloak
-                            x-show="proxyConfigurationPending || traefikOutdated"
+                            x-show="proxyConfigurationPending || traefikOutdated || proxyNotRunning"
                             class="ml-auto size-3.5 shrink-0 text-orange-500 dark:text-warning" />
                     @elseif ($menuItem['tracks_sentinel_status'] ?? false)
                         <x-reicon name="alert-triangle" x-cloak x-show="sentinelOutOfSync"
diff --git a/resources/views/components/service/configuration-sidebar.blade.php b/resources/views/components/service/configuration-sidebar.blade.php
index 318b04b8d2..208414e240 100644
--- a/resources/views/components/service/configuration-sidebar.blade.php
+++ b/resources/views/components/service/configuration-sidebar.blade.php
@@ -16,6 +16,7 @@
         ['label' => 'Import Backup', 'route' => 'project.service.import-backup', 'icon' => 'upload', 'navigate' => false],
         ['label' => 'Runtime Logs', 'route' => 'project.service.logs', 'icon' => 'unordered-list', 'navigate' => false],
         ['label' => 'Terminal', 'route' => 'project.service.command', 'icon' => 'browser-terminal', 'navigate' => false, 'visible' => auth()->user()?->can('canAccessTerminal')],
+        ['label' => 'Analytics', 'route' => 'project.service.analytics', 'icon' => 'analytics'],
         ['label' => 'Scheduled Tasks', 'route' => 'project.service.scheduled-tasks.show', 'icon' => 'calendar'],
         ['label' => 'Webhooks', 'route' => 'project.service.webhooks', 'icon' => 'notifications'],
         ['label' => 'Resource Operations', 'route' => 'project.service.resource-operations', 'icon' => 'server-update'],
@@ -35,7 +36,7 @@
 
     $menuGroups = [
         'Settings' => ['General', 'Domains', 'Environment Variables', 'Persistent Storage'],
-        'Observe & troubleshoot' => ['Runtime Logs', 'Terminal'],
+        'Observe & troubleshoot' => ['Runtime Logs', 'Terminal', 'Analytics'],
         'Automation' => ['Scheduled Tasks', 'Webhooks', 'Backups', 'Import Backup'],
         'Operations' => ['Resource Operations', 'Tags', 'Danger Zone'],
     ];
diff --git a/resources/views/livewire/analytics.blade.php b/resources/views/livewire/analytics.blade.php
index 3ae6f2f137..1e984ac775 100644
--- a/resources/views/livewire/analytics.blade.php
+++ b/resources/views/livewire/analytics.blade.php
@@ -16,7 +16,7 @@ $serverListboxOptions = array_merge(
     collect($serverOptions)->map(fn ($name, $uuid) => ['value' => $uuid, 'label' => $name])->values()->all(),
 );
 $appListboxOptions = array_merge(
-    [['value' => '', 'label' => 'All applications']],
+    [['value' => '', 'label' => 'All resources']],
     $appGroupedOptions,
 );
 ?>
@@ -54,7 +54,7 @@ $appListboxOptions = array_merge(
                      newly-scoped options (and reset value) instead of showing stale Alpine state. --}}
                 <div class="relative w-full transition-opacity sm:w-52" wire:key="app-filter-{{ $serverUuid }}"
                     wire:loading.class="pointer-events-none opacity-60" wire:target="appUuid">
-                    <x-forms.listbox id="appUuid" live :options="$appListboxOptions" placeholder="All applications" />
+                    <x-forms.listbox id="appUuid" live :options="$appListboxOptions" placeholder="All resources" />
                     <div class="absolute inset-0 hidden items-center justify-center rounded-lg bg-white/70 dark:bg-base/70"
                         wire:loading.flex wire:target="appUuid">
                         <x-loading compact aria-label="Loading analytics" />
@@ -164,7 +164,7 @@ $appListboxOptions = array_merge(
                     <span class="flex items-center text-[11px] font-medium tracking-wide text-neutral-500 uppercase dark:text-fg-dim">
                         Unique visitors
                         @if ($uniquesApproximate)
-                            {!! $approxBadge('Summed across servers; visitors seen on multiple servers may be double-counted.') !!}
+                            {!! $approxBadge('Summed across servers or services; visitors seen on more than one may be double-counted.') !!}
                         @endif
                     </span>
                     <span class="mt-1 text-xl font-semibold text-black tabular-nums dark:text-fg">{{ number_format($overview['uniqueVisitors'] ?? 0) }}</span>
@@ -208,7 +208,7 @@ $appListboxOptions = array_merge(
                     <span class="flex items-center text-[11px] font-medium tracking-wide text-neutral-500 uppercase dark:text-fg-dim">
                         p95 latency
                         @if ($latencyApproximate)
-                            {!! $approxBadge('Highest p95 latency across servers; not a true cross-server percentile.') !!}
+                            {!! $approxBadge('Highest p95 latency across servers or services; not a true merged percentile.') !!}
                         @endif
                     </span>
                     <span class="mt-1 text-xl font-semibold text-black tabular-nums dark:text-fg">{{ number_format($overview['latencyP95'] ?? 0, 1) }} ms</span>
@@ -247,7 +247,7 @@ $appListboxOptions = array_merge(
                 </x-application.settings-section>
 
                 <x-application.settings-section id="analytics-apps-section" title="Top applications"
-                    helper="Applications ranked by request volume. Open one for its analytics." flush>
+                    helper="Applications and services ranked by request volume. Open one for its analytics." flush>
                     @if (empty($topApps))
                         <x-empty size="sm" title="No application data"
                             description="No per-application requests were recorded for the selected range."
@@ -269,6 +269,9 @@ $appListboxOptions = array_merge(
                                     ])>
                                     <span class="flex min-w-0 flex-1 items-baseline gap-1.5">
                                         <span class="truncate text-[12px] text-black dark:text-fg">{{ $row['name'] }}</span>
+                                        @if (! empty($row['isService']))
+                                            <span class="shrink-0 text-[10px] font-medium tracking-wide text-neutral-400 uppercase dark:text-fg-faint">Service</span>
+                                        @endif
                                         @if (! empty($row['domain']))
                                             <span class="hidden truncate text-[11px] text-neutral-400 sm:inline dark:text-fg-faint">{{ $row['domain'] }}</span>
                                         @endif
diff --git a/resources/views/livewire/project/application/analytics.blade.php b/resources/views/livewire/project/application/analytics.blade.php
index 5a0fa32a87..692d3fda82 100644
--- a/resources/views/livewire/project/application/analytics.blade.php
+++ b/resources/views/livewire/project/application/analytics.blade.php
@@ -8,7 +8,9 @@ $dimensionLabels = [
     'browser' => 'Browsers',
     'os' => 'Operating systems',
 ];
-$analyticsServerUuid = $application->destination?->server?->uuid;
+// Shared by the application and service analytics tabs. A resource with several Sentinel
+// keys (compose services, previews) is merged, so latency and uniques become approximate.
+$approxBadge = fn (string $tooltip) => '<span title="'.e($tooltip).'" class="ml-1.5 inline-flex items-center rounded-full bg-amber-100 px-1.5 py-0.5 text-[9px] font-medium tracking-wide text-amber-700 uppercase dark:bg-amber-500/10 dark:text-amber-400">~ approximate</span>';
 ?>
 <div class="flex flex-col gap-6">
     @if (! $enabled)
@@ -76,7 +78,12 @@ $analyticsServerUuid = $application->destination?->server?->uuid;
                     </div>
                 </div>
                 <div class="flex flex-col bg-[var(--coollabs-base)] px-4 py-3">
-                    <span class="text-[11px] font-medium tracking-wide text-neutral-500 uppercase dark:text-fg-dim">Unique visitors</span>
+                    <span class="flex items-center text-[11px] font-medium tracking-wide text-neutral-500 uppercase dark:text-fg-dim">
+                        Unique visitors
+                        @if ($uniquesApproximate)
+                            {!! $approxBadge('Summed across services; visitors of more than one service may be double-counted.') !!}
+                        @endif
+                    </span>
                     <span class="mt-1 text-xl font-semibold text-black tabular-nums dark:text-fg">{{ number_format($overview['uniqueVisitors'] ?? 0) }}</span>
                     <div class="mt-auto pt-3">
                         @include('livewire.traffic._sparkline', [
@@ -115,7 +122,12 @@ $analyticsServerUuid = $application->destination?->server?->uuid;
                     </div>
                 </div>
                 <div class="col-span-2 flex flex-col bg-[var(--coollabs-base)] px-4 py-3 sm:col-span-1">
-                    <span class="text-[11px] font-medium tracking-wide text-neutral-500 uppercase dark:text-fg-dim">p95 latency</span>
+                    <span class="flex items-center text-[11px] font-medium tracking-wide text-neutral-500 uppercase dark:text-fg-dim">
+                        p95 latency
+                        @if ($latencyApproximate)
+                            {!! $approxBadge('Highest p95 latency across services; not a true merged percentile.') !!}
+                        @endif
+                    </span>
                     <span class="mt-1 text-xl font-semibold text-black tabular-nums dark:text-fg">{{ number_format($overview['latencyP95'] ?? 0, 1) }} ms</span>
                     <div class="mt-auto pt-3">
                         @include('livewire.traffic._sparkline', [
diff --git a/resources/views/livewire/project/service/configuration.blade.php b/resources/views/livewire/project/service/configuration.blade.php
index fe2799e3bb..51dd41a9f7 100644
--- a/resources/views/livewire/project/service/configuration.blade.php
+++ b/resources/views/livewire/project/service/configuration.blade.php
@@ -21,6 +21,7 @@
             ['label' => 'Import Backup', 'route' => 'project.service.import-backup', 'icon' => 'upload', 'navigate' => false],
             ['label' => 'Runtime Logs', 'route' => 'project.service.logs', 'icon' => 'unordered-list', 'navigate' => false],
             ['label' => 'Terminal', 'route' => 'project.service.command', 'icon' => 'browser-terminal', 'navigate' => false, 'visible' => auth()->user()?->can('canAccessTerminal')],
+            ['label' => 'Analytics', 'route' => 'project.service.analytics', 'icon' => 'analytics'],
             ['label' => 'Scheduled Tasks', 'route' => 'project.service.scheduled-tasks.show', 'icon' => 'calendar'],
             ['label' => 'Webhooks', 'route' => 'project.service.webhooks', 'icon' => 'notifications'],
             ['label' => 'Resource Operations', 'route' => 'project.service.resource-operations', 'icon' => 'server-update'],
@@ -35,7 +36,7 @@
 
         $menuGroups = [
             'Settings' => ['General', 'Domains', 'Environment Variables', 'Persistent Storage'],
-            'Observe & troubleshoot' => ['Runtime Logs', 'Terminal'],
+            'Observe & troubleshoot' => ['Runtime Logs', 'Terminal', 'Analytics'],
             'Automation' => ['Scheduled Tasks', 'Webhooks', 'Backups', 'Import Backup'],
             'Operations' => ['Resource Operations', 'Tags', 'Danger Zone'],
         ];
@@ -190,6 +191,9 @@
                             @endforeach
                         </div>
                     </div>
+                @elseif ($currentRoute === 'project.service.analytics')
+                    <livewire:project.service.analytics :service="$service"
+                        :lazy="(bool) ($service->server ?? $service->destination?->server)?->isTrafficAnalyticsEnabled()" />
                 @elseif ($currentRoute === 'project.service.domains')
                     <livewire:project.service.domains :service="$service" />
                 @elseif ($currentRoute === 'project.service.environment-variables')
diff --git a/resources/views/livewire/project/service/heading.blade.php b/resources/views/livewire/project/service/heading.blade.php
index 480ad3b539..dbaac3d51a 100644
--- a/resources/views/livewire/project/service/heading.blade.php
+++ b/resources/views/livewire/project/service/heading.blade.php
@@ -11,6 +11,7 @@
                     || request()->routeIs('project.service.scheduled-tasks*')
                     || request()->routeIs('project.service.webhooks')
                     || request()->routeIs('project.service.resource-operations')
+                    || request()->routeIs('project.service.analytics')
                     || request()->routeIs('project.service.tags')
                     || request()->routeIs('project.service.danger')
                     || request()->routeIs('project.service.index*')
diff --git a/resources/views/livewire/project/shared/terminal.blade.php b/resources/views/livewire/project/shared/terminal.blade.php
index b4a0961a0f..8c5bd50767 100644
--- a/resources/views/livewire/project/shared/terminal.blade.php
+++ b/resources/views/livewire/project/shared/terminal.blade.php
@@ -3,7 +3,7 @@
 @endphp
 
 <div id="terminal-container" x-data="terminalData()" data-auto-start="{{ $autoStart ? 'true' : 'false' }}"
-    x-on:terminal-starting.window="starting = true; setTerminalTheme(localStorage.getItem('coolify-console-theme') ?? 'system')"
+    x-on:terminal-starting.window="beginTerminalSessionStart(); setTerminalTheme(localStorage.getItem('coolify-console-theme') ?? 'system')"
     x-on:terminal-theme-change.window="setTerminalTheme($event.detail.theme)"
     @class([
         'group/terminal relative h-full min-h-0 bg-transparent' => $isApplicationConsole,
@@ -48,7 +48,13 @@
         @if ($isApplicationConsole)
             <div x-show="!terminalActive" x-cloak
                 class="pointer-events-none absolute inset-0 z-10 flex items-center justify-center bg-transparent">
-                <div class="terminal-loading-label flex items-center gap-2">
+                <div x-show="connectionError" x-cloak data-terminal-connection-error role="alert"
+                    class="terminal-loading-label pointer-events-auto flex max-w-md flex-col items-center gap-3 px-4 text-center">
+                    <span x-text="connectionError"></span>
+                    <button type="button" x-on:click="reloadTerminalPage()"
+                        class="cursor-pointer rounded-md border border-current/30 px-3 py-1 text-xs font-medium transition-colors hover:bg-current/10">Reload page</button>
+                </div>
+                <div x-show="!connectionError" class="terminal-loading-label flex items-center gap-2">
                     <svg x-show="starting || connectionState === 'connecting' || connectionState === 'reconnecting'"
                         class="size-3 animate-spin" viewBox="0 0 24 24" fill="none">
                         <circle class="opacity-25" cx="12" cy="12" r="9" stroke="currentColor"
@@ -61,6 +67,11 @@
                 </div>
             </div>
         @else
+            <div x-show="!terminalActive && connectionError" x-cloak data-terminal-connection-error role="alert"
+                class="mb-2 flex shrink-0 items-center gap-3 rounded-sm border border-red-500/40 bg-red-950/80 px-3 py-2 text-sm text-red-200">
+                <span x-text="connectionError"></span>
+                <button type="button" class="underline" x-on:click="reloadTerminalPage()">Reload page</button>
+            </div>
             <div x-show="terminalActive" x-cloak class="mb-2 flex shrink-0 justify-start">
                 <div class="inline-flex rounded-sm border px-2 py-1 text-xs font-medium"
                     :class="terminalSessionTimerClass()" x-text="terminalSessionRemainingLabel()">
diff --git a/resources/views/livewire/server/proxy.blade.php b/resources/views/livewire/server/proxy.blade.php
index 04b10cb609..bfb6f2a44f 100644
--- a/resources/views/livewire/server/proxy.blade.php
+++ b/resources/views/livewire/server/proxy.blade.php
@@ -36,9 +36,7 @@
                     @if (
                         $server->proxy->last_applied_settings &&
                             $server->proxy->last_saved_settings !== $server->proxy->last_applied_settings)
-                        <x-callout type="warning" title="Configuration out of sync">
-                            Restart the proxy to apply the saved configuration.
-                        </x-callout>
+                        <x-callout type="warning" title="Your configuration changed, please restart the proxy." />
                     @else
                         <div class="flex items-start gap-3">
                             <div
diff --git a/resources/views/livewire/server/traffic-analytics-settings.blade.php b/resources/views/livewire/server/traffic-analytics-settings.blade.php
index 8031654046..0cc046ba60 100644
--- a/resources/views/livewire/server/traffic-analytics-settings.blade.php
+++ b/resources/views/livewire/server/traffic-analytics-settings.blade.php
@@ -27,6 +27,9 @@
             </x-slot:actions>
 
             @if ($isTrafficAnalyticsEnabled)
+                @if ($caddyRedeployNote)
+                    <x-callout type="info" title="Redeploy to start logging">{{ $caddyRedeployNote }}</x-callout>
+                @endif
                 <div class="grid gap-4 lg:grid-cols-2">
                     <x-forms.input canGate="update" :canResource="$server" type="number" min="1"
                         id="trafficTopn" label="Top-N cap" required
@@ -56,10 +59,15 @@
                 </div>
             @else
                 <x-empty size="sm" title="Traffic analytics is disabled"
-                    description="Enable traffic analytics to collect proxy access logs and geolocate visitor traffic."
+                    :description="$unsupportedReason ?? 'Enable traffic analytics to collect proxy access logs and geolocate visitor traffic.'"
                     icon-name="dashboard">
                     <x-slot:contents>
                         <div class="flex items-center gap-3">
+                            @if ($unsupportedReason)
+                                <x-forms.button disabled :tooltip="$unsupportedReason">
+                                    Enable traffic analytics
+                                </x-forms.button>
+                            @else
                             <x-loading wire:loading.flex wire:target="toggleTrafficAnalytics"
                                 text="Restarting Sentinel and proxy..." compact />
                             <x-modal-confirmation title="Enable traffic analytics?"
@@ -72,6 +80,7 @@
                                 step2ButtonText="Enable traffic analytics" isHighlightedButton
                                 :disabled="! auth()->user()->can('update', $server)"
                                 :authDisabled="! auth()->user()->can('update', $server)" />
+                            @endif
                         </div>
                     </x-slot:contents>
                 </x-empty>
diff --git a/routes/web.php b/routes/web.php
index 712c415b79..a3ca3630f1 100644
--- a/routes/web.php
+++ b/routes/web.php
@@ -339,6 +339,7 @@ Route::middleware(['auth', 'verified'])->group(function () {
         Route::get('/', ServiceConfiguration::class)->name('project.service.configuration');
         Route::get('/domains', ServiceConfiguration::class)->name('project.service.domains');
         Route::get('/logs', Logs::class)->name('project.service.logs');
+        Route::get('/analytics', ServiceConfiguration::class)->name('project.service.analytics');
         Route::get('/environment-variables', ServiceConfiguration::class)->name('project.service.environment-variables');
         Route::get('/storages', ServiceConfiguration::class)->name('project.service.storages');
         Route::get('/import-backup', ServiceImportBackup::class)->name('project.service.import-backup')->middleware('can.update.resource');
diff --git a/tests/Feature/AdvisorySecurityRegressionTest.php b/tests/Feature/AdvisorySecurityRegressionTest.php
index 62af383364..c9d9469bb7 100644
--- a/tests/Feature/AdvisorySecurityRegressionTest.php
+++ b/tests/Feature/AdvisorySecurityRegressionTest.php
@@ -67,19 +67,26 @@ it('throttles only failed authentication on manual webhook routes', function (st
     {
         use MatchesManualWebhookApplications;
 
-        public function reply(array $payloads, Request $request, string $provider): int
+        public function key(Request $request, string $provider): string
         {
-            return $this->manualWebhookResponse(collect($payloads), $request, $provider)->getStatusCode();
+            return $this->manualWebhookFailureRateLimitKey($request, $provider, 'test-org/test-repo', 'main');
+        }
+
+        public function reply(array $payloads, string $failureKey): int
+        {
+            return $this->manualWebhookResponse(collect($payloads), $failureKey)->getStatusCode();
         }
     };
+    $failureKey = $helper->key($request, $provider);
 
     expect($route->gatherMiddleware())->not->toContain('throttle:60,1');
+    expect($failureKey)->toStartWith("manual-webhook-failures:{$provider}:192.0.2.44:");
 
-    $helper->reply([['status' => 'success', 'message' => 'queued']], $request, $provider);
-    expect(RateLimiter::attempts("manual-webhook-failures:{$provider}:192.0.2.44"))->toBe(0);
+    $helper->reply([['status' => 'success', 'message' => 'queued']], $failureKey);
+    expect(RateLimiter::attempts($failureKey))->toBe(0);
 
-    $helper->reply([['status' => 'failed', 'message' => 'Invalid signature.']], $request, $provider);
-    expect(RateLimiter::attempts("manual-webhook-failures:{$provider}:192.0.2.44"))->toBe(1);
+    $helper->reply([['status' => 'failed', 'message' => 'Invalid signature.']], $failureKey);
+    expect(RateLimiter::attempts($failureKey))->toBe(1);
 })->with(['github', 'gitlab', 'bitbucket', 'gitea']);
 
 it('does not reveal how many applications share a manual webhook repository', function () {
@@ -89,7 +96,7 @@ it('does not reveal how many applications share a manual webhook repository', fu
 
         public function reply(array $payloads): string
         {
-            return $this->manualWebhookResponse(collect($payloads), Request::create('/webhooks/source/github/events/manual', 'POST'), 'github')->getContent();
+            return $this->manualWebhookResponse(collect($payloads), 'manual-webhook-failures:test')->getContent();
         }
     };
     $failure = ['status' => 'failed', 'message' => 'Invalid signature.'];
diff --git a/tests/Feature/ApplicationDeploymentControlVarFilteringTest.php b/tests/Feature/ApplicationDeploymentControlVarFilteringTest.php
index 1aa668e116..5f61f78c47 100644
--- a/tests/Feature/ApplicationDeploymentControlVarFilteringTest.php
+++ b/tests/Feature/ApplicationDeploymentControlVarFilteringTest.php
@@ -1030,6 +1030,94 @@ it('rejects existing variable names that would break the .env file or build comm
     'build-time name with a hyphen' => ['my-var', true],
 ]);
 
+it('warns instead of failing for invalid build-time names when the deployment does not build an image', function (bool $isRuntime) {
+    [$application, $server] = makeDeploymentControlVarFixture(['build_pack' => 'dockerimage']);
+    $environmentVariable = createApplicationEnvironmentVariable($application, [
+        'key' => 'SAFE_KEY',
+        'value' => 'secret',
+        'is_buildtime' => true,
+        'is_runtime' => $isRuntime,
+    ]);
+    DB::table('environment_variables')->where('id', $environmentVariable->id)->update(['key' => 'my-var']);
+
+    [$job, $reflection] = makeControlVarFilteringJob($application->fresh(), $server);
+    invokeDeploymentJobMethod($job, $reflection, 'validateDeploymentEnvironmentVariableKeys');
+
+    expect(collect($job->recordedLogEntries)->implode("\n"))
+        ->toContain('my-var')
+        ->toContain('Suggested name: my_var')
+        ->not->toContain('Invalid environment variable name');
+    expect($job->recordedCommands)->toBeEmpty();
+})->with([
+    'build-time only' => [false],
+    'build-time and runtime' => [true],
+]);
+
+it('warns instead of failing for invalid build-time preview names of Docker image deployments', function () {
+    [$application, $server] = makeDeploymentControlVarFixture(['build_pack' => 'dockerimage']);
+    $environmentVariable = createApplicationEnvironmentVariable($application, [
+        'key' => 'SAFE_KEY',
+        'value' => 'secret',
+        'is_buildtime' => true,
+        'is_preview' => true,
+    ]);
+    DB::table('environment_variables')->where('id', $environmentVariable->id)->update(['key' => 'my-var']);
+
+    [$job, $reflection] = makeControlVarFilteringJob($application->fresh(), $server, ['pull_request_id' => 7]);
+    invokeDeploymentJobMethod($job, $reflection, 'validateDeploymentEnvironmentVariableKeys');
+
+    expect(collect($job->recordedLogEntries)->implode("\n"))
+        ->toContain('Suggested name: my_var')
+        ->not->toContain('Invalid environment variable name');
+});
+
+it('still rejects Docker image variable names that would break the .env file', function () {
+    [$application, $server] = makeDeploymentControlVarFixture(['build_pack' => 'dockerimage']);
+    $environmentVariable = createApplicationEnvironmentVariable($application, [
+        'key' => 'SAFE_KEY',
+        'value' => 'secret',
+        'is_buildtime' => true,
+    ]);
+    DB::table('environment_variables')->where('id', $environmentVariable->id)->update(['key' => 'A=B']);
+
+    [$job, $reflection] = makeControlVarFilteringJob($application->fresh(), $server);
+
+    expect(fn () => invokeDeploymentJobMethod($job, $reflection, 'validateDeploymentEnvironmentVariableKeys'))
+        ->toThrow(DeploymentException::class, 'Invalid environment variable name from the deployment environment');
+});
+
+it('fails with a clear message for invalid build-time names when the deployment builds an image', function (string $buildPack) {
+    [$application, $server] = makeDeploymentControlVarFixture(['build_pack' => $buildPack]);
+    $environmentVariable = createApplicationEnvironmentVariable($application, [
+        'key' => 'SAFE_KEY',
+        'value' => 'secret',
+        'is_buildtime' => true,
+    ]);
+    DB::table('environment_variables')->where('id', $environmentVariable->id)->update(['key' => 'my-var']);
+
+    [$job, $reflection] = makeControlVarFilteringJob($application->fresh(), $server, ['build_pack' => $buildPack]);
+
+    expect(fn () => invokeDeploymentJobMethod($job, $reflection, 'validateDeploymentEnvironmentVariableKeys'))
+        ->toThrow(DeploymentException::class, 'Invalid environment variable name from the deployment environment: my-var');
+    expect(collect($job->recordedLogEntries)->implode("\n"))
+        ->toContain('Build-time variable names must start with a letter or underscore');
+})->with(['dockerfile', 'nixpacks', 'static', 'railpack', 'dockercompose']);
+
+it('does not pass build-time variables to the helper container of Docker image deployments', function () {
+    [$application, $server] = makeDeploymentControlVarFixture(['build_pack' => 'dockerimage']);
+    $application->settings()->update(['use_build_secrets' => true]);
+    $environmentVariable = createApplicationEnvironmentVariable($application, [
+        'key' => 'SAFE_KEY',
+        'value' => 'harmless-build-value',
+        'is_buildtime' => true,
+    ]);
+    DB::table('environment_variables')->where('id', $environmentVariable->id)->update(['key' => 'my-var']);
+
+    [$job, $reflection] = makeControlVarFilteringJob($application->fresh(), $server);
+
+    expect(invokeDeploymentJobMethod($job, $reflection, 'generate_docker_env_flags_for_secrets'))->toBe('');
+});
+
 it('injects raw escaped remote secrets into Dockerfile args and hashes the same values', function (int $pullRequestId, bool $isPreview) {
     [$application, $server] = makeDeploymentControlVarFixture();
 
diff --git a/tests/Feature/ComposeBuildContextDeploymentTest.php b/tests/Feature/ComposeBuildContextDeploymentTest.php
index 581179a47f..d515a815d5 100644
--- a/tests/Feature/ComposeBuildContextDeploymentTest.php
+++ b/tests/Feature/ComposeBuildContextDeploymentTest.php
@@ -58,7 +58,7 @@ function composeDockerfile(string $path): string
     return $path;
 }
 
-function runComposeArgInjection(object $test, mixed $build, string $workdir): LocallyExecutedComposeDeploymentJob
+function runComposeArgInjection(object $test, mixed $build, string $workdir, array $envArgs = ['APP_ENV' => 'production']): LocallyExecutedComposeDeploymentJob
 {
     $application = Application::factory()->create(['build_pack' => 'dockercompose']);
     $application->settings()->update(['inject_build_args_to_dockerfile' => true]);
@@ -76,7 +76,7 @@ function runComposeArgInjection(object $test, mixed $build, string $workdir): Lo
         'deployment_uuid' => 'deployment-uuid',
         'basedir' => $test->basedir,
         'workdir' => $workdir,
-        'env_args' => collect(['APP_ENV' => 'production']),
+        'env_args' => collect($envArgs),
         'saved_outputs' => collect(),
         'dockerSecretsSupported' => false,
         'pull_request_id' => 0,
@@ -106,19 +106,45 @@ test('compose deployments inject build args for Dockerfiles inside the repositor
     'custom Dockerfile in a parent folder' => [['context' => 'services/api', 'dockerfile' => '../docker/api.Dockerfile'], '', 'services/docker/api.Dockerfile'],
 ]);
 
-test('compose deployments skip build contexts they cannot inspect locally', function (mixed $build) {
+test('compose deployments skip build contexts they cannot inspect locally', function (mixed $build, string $reason) {
     $dockerfile = composeDockerfile($this->basedir.'/Dockerfile');
 
-    $job = runComposeArgInjection($this, $build, $this->basedir);
+    $job = runComposeArgInjection($this, $build, $this->basedir, [
+        'COOLIFY_URL' => 'https://secret-host.example.com',
+        'APP_ENV' => 'production-secret-value',
+        'API_TOKEN' => 'super-secret-token',
+    ]);
 
     expect(file_get_contents($dockerfile))->not->toContain('ARG APP_ENV')
-        ->and($job->logEntries)->toContain('The build context of service api is remote or uses variables, skipping ARG injection.');
+        ->and($job->logEntries)->toContain("Skipping ARG injection for service api: {$reason}. Docker ignores build-time variables that the Dockerfile does not declare, so add 'ARG <NAME>' lines to the Dockerfile for the ones you need: APP_ENV, API_TOKEN, COOLIFY_URL.")
+        ->and(implode("\n", $job->logEntries))->not->toContain('secret');
 })->with([
-    'git URL' => ['https://github.com/coollabsio/coolify.git#main:docker'],
-    'context variable' => ['${APP_DIR:-.}'],
-    'inline Dockerfile' => [['context' => '.', 'dockerfile_inline' => "FROM alpine\n"]],
+    'git URL' => ['https://github.com/coollabsio/coolify.git#main:docker', 'the build context is a remote Git URL'],
+    'git SSH URL' => [['context' => 'git@github.com:coollabsio/coolify.git'], 'the build context is a remote Git URL'],
+    'context variable' => ['${APP_DIR:-.}', 'the build context or Dockerfile path uses variables'],
+    'Dockerfile variable' => [['context' => '.', 'dockerfile' => '${DOCKERFILE}'], 'the build context or Dockerfile path uses variables'],
+    'inline Dockerfile' => [['context' => '.', 'dockerfile_inline' => "FROM alpine\n"], 'the service uses an inline Dockerfile (dockerfile_inline)'],
+    'invalid build definition' => [['context' => ['nested']], 'Coolify cannot read the build definition'],
 ]);
 
+test('skipped ARG injection lists at most ten build-time variable names', function () {
+    composeDockerfile($this->basedir.'/Dockerfile');
+    $envArgs = collect(range(1, 13))->mapWithKeys(fn (int $number) => ["VAR_{$number}" => "value-{$number}"])->all();
+
+    $job = runComposeArgInjection($this, '${APP_DIR}', $this->basedir, $envArgs);
+
+    expect($job->logEntries)->toContain("Skipping ARG injection for service api: the build context or Dockerfile path uses variables. Docker ignores build-time variables that the Dockerfile does not declare, so add 'ARG <NAME>' lines to the Dockerfile for the ones you need: VAR_1, VAR_2, VAR_3, VAR_4, VAR_5, VAR_6, VAR_7, VAR_8, VAR_9, VAR_10 and 3 more.")
+        ->and(implode("\n", $job->logEntries))->not->toContain('value-');
+});
+
+test('skipped ARG injection does not show invalid build-time variable names', function () {
+    composeDockerfile($this->basedir.'/Dockerfile');
+
+    $job = runComposeArgInjection($this, '${APP_DIR}', $this->basedir, ['BAD NAME;id' => 'x', 'GOOD_NAME' => 'y']);
+
+    expect($job->logEntries)->toContain("Skipping ARG injection for service api: the build context or Dockerfile path uses variables. Docker ignores build-time variables that the Dockerfile does not declare, so add 'ARG <NAME>' lines to the Dockerfile for the ones you need: GOOD_NAME.");
+});
+
 test('compose deployments never change Dockerfiles outside the repository', function (string $escape) {
     $outside = composeDockerfile($this->root.'/outside/Dockerfile');
     symlink($this->root.'/outside', $this->basedir.'/linked');
diff --git a/tests/Feature/DangerZoneLayoutTest.php b/tests/Feature/DangerZoneLayoutTest.php
index 6f212301f8..5395958c73 100644
--- a/tests/Feature/DangerZoneLayoutTest.php
+++ b/tests/Feature/DangerZoneLayoutTest.php
@@ -5,10 +5,11 @@ it('uses one shared visual treatment for all danger zone actions', function () {
 
     expect($component)
         ->toContain("@props(['title'])")
-        ->toContain('sm:flex-row sm:items-center sm:justify-between')
-        ->toContain('text-red-700 dark:text-red-300')
-        ->toContain('@isset($action)')
-        ->not->toContain('bg-red-50');
+        ->toContain('sm:flex-row sm:items-start sm:justify-between')
+        ->toContain('rounded-lg border border-red-200 bg-red-50')
+        ->toContain('dark:border-red-500/25 dark:bg-red-500/[0.08]')
+        ->toContain('Permanent')
+        ->toContain('@isset($action)');
 
     foreach ([
         'livewire/destination/show.blade.php',
diff --git a/tests/Feature/DatabaseStartConcurrencyTest.php b/tests/Feature/DatabaseStartConcurrencyTest.php
new file mode 100644
index 0000000000..3645368e30
--- /dev/null
+++ b/tests/Feature/DatabaseStartConcurrencyTest.php
@@ -0,0 +1,276 @@
+<?php
+
+use App\Actions\Database\RestartDatabase;
+use App\Actions\Database\StartDatabase;
+use App\Actions\Database\StartPostgresql;
+use App\Actions\Database\StopDatabase;
+use App\Enums\ActivityTypes;
+use App\Enums\ProcessStatus;
+use App\Events\DatabaseStatusChanged;
+use App\Jobs\DatabaseStartJob;
+use App\Livewire\Project\Database\Heading;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\StandalonePostgresql;
+use App\Models\Team;
+use App\Models\User;
+use App\Support\ResourceStartActivity;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Bus;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\Event;
+use Illuminate\Support\Facades\Queue;
+use Illuminate\Support\Str;
+use Livewire\Livewire;
+use Spatie\Activitylog\Models\Activity;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::forceCreate(['id' => 0]);
+    config()->set('cache.default', 'array');
+
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user, ['role' => 'owner']);
+    session(['currentTeam' => $this->team]);
+    $this->bearerToken = $this->user->createToken('test-token', ['*'])->plainTextToken;
+
+    $this->server = Server::factory()->create(['team_id' => $this->team->id]);
+    $this->server->settings()->update([
+        'is_reachable' => true,
+        'is_usable' => true,
+        'force_disabled' => false,
+    ]);
+    $this->destination = StandaloneDocker::firstOrCreate(
+        ['server_id' => $this->server->id, 'network' => 'coolify'],
+        ['uuid' => (string) Str::uuid(), 'name' => 'docker']
+    );
+    $project = Project::factory()->create(['team_id' => $this->team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+    $this->database = StandalonePostgresql::create([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'db',
+        'postgres_user' => 'postgres',
+        'postgres_password' => 'password',
+        'postgres_db' => 'db',
+        'image' => 'postgres:17',
+        'status' => 'exited',
+        'environment_id' => $environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+    ]);
+});
+
+function concurrentStartActivity(string $databaseUuid, int $teamId, ProcessStatus $status = ProcessStatus::QUEUED, int $minutesSinceLastUpdate = 0): Activity
+{
+    $activity = activity()
+        ->withProperties([
+            'type' => ActivityTypes::INLINE->value,
+            'type_uuid' => $databaseUuid,
+            'status' => $status->value,
+            'team_id' => $teamId,
+            'operation' => ResourceStartActivity::DATABASE_START_OPERATION,
+        ])
+        ->event(ActivityTypes::INLINE->value)
+        ->log('[]');
+
+    Activity::query()->whereKey($activity->id)->update([
+        'created_at' => now()->subMinutes($minutesSinceLastUpdate),
+        'updated_at' => now()->subMinutes($minutesSinceLastUpdate),
+    ]);
+
+    return $activity->refresh();
+}
+
+function databaseStartActivityCount(string $databaseUuid): int
+{
+    return Activity::query()
+        ->where('properties->type_uuid', $databaseUuid)
+        ->where('properties->operation', ResourceStartActivity::DATABASE_START_OPERATION)
+        ->count();
+}
+
+function databaseStartApiHeaders(string $token): array
+{
+    return ['Authorization' => 'Bearer '.$token, 'Content-Type' => 'application/json'];
+}
+
+describe('start and restart guards', function () {
+    it('does not queue a second start from the UI while a start is queued', function () {
+        Bus::fake();
+        concurrentStartActivity($this->database->uuid, $this->team->id);
+
+        Livewire::actingAs($this->user)->test(Heading::class, ['database' => $this->database])
+            ->call('start')
+            ->assertDispatched('error', ResourceStartActivity::DATABASE_OPERATION_IN_PROGRESS_MESSAGE);
+
+        Bus::assertNotDispatched(DatabaseStartJob::class);
+        expect(databaseStartActivityCount($this->database->uuid))->toBe(1);
+    });
+
+    it('does not stop the database on a UI restart while a start is in progress', function () {
+        Bus::fake();
+        StopDatabase::shouldRun()->never();
+        concurrentStartActivity($this->database->uuid, $this->team->id, ProcessStatus::IN_PROGRESS);
+
+        Livewire::actingAs($this->user)->test(Heading::class, ['database' => $this->database])
+            ->call('restart')
+            ->assertDispatched('error', ResourceStartActivity::DATABASE_OPERATION_IN_PROGRESS_MESSAGE);
+
+        Bus::assertNotDispatched(DatabaseStartJob::class);
+        expect(databaseStartActivityCount($this->database->uuid))->toBe(1);
+    });
+
+    it('rejects an API start while a start is queued', function () {
+        Queue::fake();
+        concurrentStartActivity($this->database->uuid, $this->team->id);
+
+        $this->withHeaders(databaseStartApiHeaders($this->bearerToken))
+            ->postJson("/api/v1/databases/{$this->database->uuid}/start")
+            ->assertStatus(409)
+            ->assertJson(['message' => ResourceStartActivity::DATABASE_OPERATION_IN_PROGRESS_MESSAGE]);
+
+        StartDatabase::assertNotPushed();
+    });
+
+    it('rejects an API restart while a start is queued', function () {
+        Queue::fake();
+        concurrentStartActivity($this->database->uuid, $this->team->id);
+
+        $this->withHeaders(databaseStartApiHeaders($this->bearerToken))
+            ->postJson("/api/v1/databases/{$this->database->uuid}/restart")
+            ->assertStatus(409)
+            ->assertJson(['message' => ResourceStartActivity::DATABASE_OPERATION_IN_PROGRESS_MESSAGE]);
+
+        RestartDatabase::assertNotPushed();
+    });
+
+    it('still queues an API start when no start is running', function () {
+        Queue::fake();
+        concurrentStartActivity($this->database->uuid, $this->team->id, ProcessStatus::FINISHED);
+
+        $this->withHeaders(databaseStartApiHeaders($this->bearerToken))
+            ->postJson("/api/v1/databases/{$this->database->uuid}/start")
+            ->assertOk();
+
+        StartDatabase::assertPushed();
+    });
+
+    it('does not reveal a running start of another team database through the API', function () {
+        Queue::fake();
+        concurrentStartActivity($this->database->uuid, $this->team->id);
+        $otherTeam = Team::factory()->create();
+        $otherUser = User::factory()->create();
+        $otherTeam->members()->attach($otherUser, ['role' => 'owner']);
+        session(['currentTeam' => $otherTeam]);
+        $otherToken = $otherUser->createToken('other-token', ['*'])->plainTextToken;
+
+        $this->withHeaders(databaseStartApiHeaders($otherToken))
+            ->postJson("/api/v1/databases/{$this->database->uuid}/start")
+            ->assertNotFound();
+
+        StartDatabase::assertNotPushed();
+    });
+
+    it('refuses to queue a second start in the action itself', function () {
+        Bus::fake();
+        concurrentStartActivity($this->database->uuid, $this->team->id);
+
+        expect(StartDatabase::run($this->database))->toBe(ResourceStartActivity::DATABASE_OPERATION_IN_PROGRESS_MESSAGE);
+
+        Bus::assertNotDispatched(DatabaseStartJob::class);
+        expect(databaseStartActivityCount($this->database->uuid))->toBe(1);
+    });
+
+    it('does not stop the database when a queued restart action finds a running start', function () {
+        Bus::fake();
+        StopDatabase::shouldRun()->never();
+        concurrentStartActivity($this->database->uuid, $this->team->id, ProcessStatus::IN_PROGRESS);
+
+        expect(RestartDatabase::run($this->database))->toBe(ResourceStartActivity::DATABASE_OPERATION_IN_PROGRESS_MESSAGE);
+    });
+
+    it('lets a new start replace a stale queued start and marks the stale one as failed', function () {
+        Bus::fake();
+        $stale = concurrentStartActivity($this->database->uuid, $this->team->id, minutesSinceLastUpdate: 11);
+
+        expect(StartDatabase::run($this->database))->toBeInstanceOf(Activity::class);
+
+        Bus::assertDispatched(DatabaseStartJob::class);
+        $stale->refresh();
+        expect(data_get($stale, 'properties.status'))->toBe(ProcessStatus::ERROR->value)
+            ->and(data_get($stale, 'properties.error'))->toBe(ResourceStartActivity::STALE_MESSAGE);
+    });
+});
+
+describe('start job', function () {
+    beforeEach(function () {
+        Event::fake([DatabaseStatusChanged::class]);
+    });
+
+    it('does not run the start commands while another start of the same database holds the lock', function () {
+        StartPostgresql::shouldRun()->never();
+        $activity = concurrentStartActivity($this->database->uuid, $this->team->id);
+        $lock = Cache::lock(ResourceStartActivity::databaseStartLockKey($this->database->uuid), 60);
+        expect($lock->get())->toBeTrue();
+
+        try {
+            DatabaseStartJob::dispatchSync(StandalonePostgresql::class, $this->database->id, $this->team->id, $activity->id, null);
+        } finally {
+            $lock->release();
+        }
+
+        $activity->refresh();
+        expect(data_get($activity, 'properties.status'))->toBe(ProcessStatus::ERROR->value)
+            ->and(data_get($activity, 'properties.error'))->toBe(ResourceStartActivity::ALREADY_STARTING_MESSAGE);
+    });
+
+    it('holds the start lock while the start commands run and releases it afterwards', function () {
+        $activity = concurrentStartActivity($this->database->uuid, $this->team->id);
+        $lockKey = ResourceStartActivity::databaseStartLockKey($this->database->uuid);
+        $lockWasHeld = null;
+        StartPostgresql::shouldRun()->once()->andReturnUsing(function ($database, Activity $activity) use ($lockKey, &$lockWasHeld) {
+            $probe = Cache::lock($lockKey, 60);
+            $lockWasHeld = ! $probe->get();
+            if (! $lockWasHeld) {
+                $probe->release();
+            }
+            $activity->properties = $activity->properties->merge(['status' => ProcessStatus::FINISHED->value]);
+            $activity->save();
+
+            return $activity;
+        });
+
+        DatabaseStartJob::dispatchSync(StandalonePostgresql::class, $this->database->id, $this->team->id, $activity->id, null);
+
+        expect($lockWasHeld)->toBeTrue();
+        $lock = Cache::lock($lockKey, 60);
+        expect($lock->get())->toBeTrue();
+        $lock->release();
+    });
+
+    it('skips a start that a newer start of the same database replaced', function () {
+        StartPostgresql::shouldRun()->never();
+        $older = concurrentStartActivity($this->database->uuid, $this->team->id, minutesSinceLastUpdate: 20);
+        concurrentStartActivity($this->database->uuid, $this->team->id);
+
+        DatabaseStartJob::dispatchSync(StandalonePostgresql::class, $this->database->id, $this->team->id, $older->id, null);
+
+        $older->refresh();
+        expect(data_get($older, 'properties.status'))->toBe(ProcessStatus::ERROR->value)
+            ->and(data_get($older, 'properties.error'))->toBe(ResourceStartActivity::SUPERSEDED_MESSAGE);
+    });
+
+    it('skips a start whose activity is no longer queued', function () {
+        StartPostgresql::shouldRun()->never();
+        $activity = concurrentStartActivity($this->database->uuid, $this->team->id, ProcessStatus::ERROR);
+
+        DatabaseStartJob::dispatchSync(StandalonePostgresql::class, $this->database->id, $this->team->id, $activity->id, null);
+
+        expect(data_get($activity->refresh(), 'properties.status'))->toBe(ProcessStatus::ERROR->value);
+    });
+});
diff --git a/tests/Feature/DeploymentSensitiveCommandFailureTest.php b/tests/Feature/DeploymentSensitiveCommandFailureTest.php
new file mode 100644
index 0000000000..2fa3798d2e
--- /dev/null
+++ b/tests/Feature/DeploymentSensitiveCommandFailureTest.php
@@ -0,0 +1,449 @@
+<?php
+
+use App\Exceptions\DeploymentException;
+use App\Jobs\ApplicationDeploymentJob;
+use App\Models\Application;
+use App\Models\ApplicationDeploymentQueue;
+use App\Models\Environment;
+use App\Models\EnvironmentVariable;
+use App\Models\PrivateKey;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Process\PendingProcess;
+use Illuminate\Support\Collection;
+use Illuminate\Support\Facades\Process;
+use Illuminate\Support\Facades\Storage;
+
+uses(RefreshDatabase::class);
+
+const SENSITIVE_FAILURE_SECRET = 'harmless-secret-marker-7431';
+
+class SensitiveCommandFailureDeploymentJob extends ApplicationDeploymentJob
+{
+    public function __construct() {}
+}
+
+beforeEach(function () {
+    config()->set('constants.ssh.mux_enabled', false);
+    config()->set('constants.ssh.max_retries', 1);
+});
+
+/**
+ * @return array{0: SensitiveCommandFailureDeploymentJob, 1: ReflectionClass, 2: ApplicationDeploymentQueue, 3: Application}
+ */
+function makeSensitiveCommandFailureJob(array $environmentVariables = []): array
+{
+    $user = User::factory()->create();
+    $team = $user->teams()->first();
+
+    $privateKeyContent = "-----BEGIN OPENSSH PRIVATE KEY-----\n"
+        ."b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW\n"
+        ."QyNTUxOQAAACBbhpqHhqv6aI67Mj9abM3DVbmcfYhZAhC7ca4d9UCevAAAAJi/QySHv0Mk\n"
+        ."hwAAAAtzc2gtZWQyNTUxOQAAACBbhpqHhqv6aI67Mj9abM3DVbmcfYhZAhC7ca4d9UCevA\n"
+        ."AAAECBQw4jg1WRT2IGHMncCiZhURCts2s24HoDS0thHnnRKVuGmoeGq/pojrsyP1pszcNV\n"
+        ."uZx9iFkCELtxrh31QJ68AAAAEXNhaWxANzZmZjY2ZDJlMmRkAQIDBA==\n"
+        .'-----END OPENSSH PRIVATE KEY-----';
+
+    $privateKey = PrivateKey::create([
+        'name' => 'sensitive-failure-key-'.uniqid(),
+        'private_key' => $privateKeyContent,
+        'team_id' => $team->id,
+    ]);
+
+    Storage::fake('ssh-keys');
+    Storage::disk('ssh-keys')->put("ssh_key@{$privateKey->uuid}", $privateKeyContent);
+
+    $server = Server::factory()->create([
+        'team_id' => $team->id,
+        'private_key_id' => $privateKey->id,
+        'user' => 'root',
+    ]);
+
+    $project = Project::create(['name' => 'Sensitive Failure Project', 'team_id' => $team->id]);
+    $environment = Environment::where('project_id', $project->id)->firstOrFail();
+    $application = Application::factory()->create([
+        'environment_id' => $environment->id,
+        'build_pack' => 'dockerfile',
+    ]);
+    $application->settings()->update([
+        'include_source_commit_in_build' => false,
+        'is_env_sorting_enabled' => false,
+    ]);
+
+    foreach ($environmentVariables as $attributes) {
+        EnvironmentVariable::create([
+            'resourceable_type' => Application::class,
+            'resourceable_id' => $application->id,
+            'is_preview' => false,
+            'is_runtime' => true,
+            'is_buildtime' => true,
+            'is_multiline' => false,
+            'is_literal' => false,
+            ...$attributes,
+        ]);
+    }
+
+    $queue = ApplicationDeploymentQueue::create([
+        'deployment_uuid' => 'sensitive-failure-deployment',
+        'application_id' => $application->id,
+        'server_id' => $server->id,
+        'status' => 'in_progress',
+    ]);
+
+    $job = new SensitiveCommandFailureDeploymentJob;
+    $reflection = new ReflectionClass(ApplicationDeploymentJob::class);
+
+    foreach ([
+        'application' => $application->fresh(),
+        'application_deployment_queue' => $queue,
+        'server' => $server,
+        'mainServer' => $server,
+        'build_pack' => 'dockerfile',
+        'pull_request_id' => 0,
+        'commit' => 'HEAD',
+        'basedir' => '/artifacts/sensitive-failure',
+        'workdir' => '/artifacts/sensitive-failure',
+        'configuration_dir' => '/data/coolify/applications/sensitive-failure',
+        'deployment_uuid' => 'sensitive-failure-deployment',
+        'dockerfile_location' => '/Dockerfile',
+        'container_name' => 'sensitive-failure-app',
+        'coolify_variables' => null,
+        'dockerSecretsSupported' => false,
+        'saved_outputs' => new Collection,
+    ] as $property => $value) {
+        $reflectionProperty = $reflection->getProperty($property);
+        $reflectionProperty->setAccessible(true);
+        $reflectionProperty->setValue($job, $value);
+    }
+
+    return [$job, $reflection, $queue, $application];
+}
+
+function invokeSensitiveFailureJobMethod(object $job, ReflectionClass $reflection, string $method, mixed ...$arguments): mixed
+{
+    $reflectionMethod = $reflection->getMethod($method);
+    $reflectionMethod->setAccessible(true);
+
+    return $reflectionMethod->invoke($job, ...$arguments);
+}
+
+function captureDeploymentException(callable $callback): DeploymentException
+{
+    try {
+        $callback();
+    } catch (DeploymentException $exception) {
+        return $exception;
+    }
+
+    throw new RuntimeException('Expected a DeploymentException.');
+}
+
+/**
+ * @return list<string>
+ */
+function base64PayloadsInCommand(string $command): array
+{
+    preg_match_all('~[A-Za-z0-9+/]{16,}={0,2}~', $command, $matches);
+
+    return array_values(array_filter(
+        $matches[0],
+        static fn (string $candidate): bool => str_contains((string) base64_decode($candidate, true), SENSITIVE_FAILURE_SECRET)
+    ));
+}
+
+it('hides the .env write command and its base64 payload when the write fails', function () {
+    [$job, $reflection, $queue] = makeSensitiveCommandFailureJob([
+        ['key' => 'APP_SECRET', 'value' => SENSITIVE_FAILURE_SECRET],
+    ]);
+
+    $payloads = [];
+    Process::fake(function (PendingProcess $process) use (&$payloads) {
+        $payloads = array_merge($payloads, base64PayloadsInCommand($process->command));
+
+        return Process::result(errorOutput: 'tee: /artifacts/sensitive-failure/.env: No space left on device', exitCode: 1);
+    });
+
+    $exception = captureDeploymentException(fn () => invokeSensitiveFailureJobMethod($job, $reflection, 'save_runtime_environment_variables'));
+
+    expect($payloads)->not->toBeEmpty();
+    expect($exception->getMessage())
+        ->toContain('Command execution failed (exit code 1): [command hidden because it contains sensitive data]')
+        ->toContain('No space left on device')
+        ->not->toContain(SENSITIVE_FAILURE_SECRET)
+        ->not->toContain('base64 -d');
+    foreach ($payloads as $payload) {
+        expect($exception->getMessage())->not->toContain($payload);
+    }
+
+    $storedLogs = (string) $queue->fresh()->logs;
+    expect($storedLogs)
+        ->toContain('No space left on device')
+        ->not->toContain(SENSITIVE_FAILURE_SECRET);
+    foreach ($payloads as $payload) {
+        expect($storedLogs)->not->toContain($payload);
+    }
+});
+
+it('redacts the sensitive payload when the error output echoes the command', function () {
+    [$job, $reflection, $queue] = makeSensitiveCommandFailureJob([
+        ['key' => 'APP_SECRET', 'value' => SENSITIVE_FAILURE_SECRET],
+    ]);
+
+    $payloads = [];
+    Process::fake(function (PendingProcess $process) use (&$payloads) {
+        $commandPayloads = base64PayloadsInCommand($process->command);
+        $payloads = array_merge($payloads, $commandPayloads);
+
+        return Process::result(errorOutput: "bash: line 1: echo '".($commandPayloads[0] ?? '')."': unexpected failure", exitCode: 2);
+    });
+
+    $exception = captureDeploymentException(fn () => invokeSensitiveFailureJobMethod($job, $reflection, 'save_runtime_environment_variables'));
+
+    expect($payloads)->not->toBeEmpty();
+    $storedLogs = (string) $queue->fresh()->logs;
+    foreach ($payloads as $payload) {
+        expect($exception->getMessage())->not->toContain($payload);
+        expect($storedLogs)->not->toContain($payload);
+    }
+    expect($exception->getMessage())->toContain('unexpected failure');
+});
+
+it('hides the build-time env write command when the write fails', function () {
+    [$job, $reflection] = makeSensitiveCommandFailureJob([
+        ['key' => 'BUILD_SECRET', 'value' => SENSITIVE_FAILURE_SECRET, 'is_runtime' => false],
+    ]);
+
+    $payloads = [];
+    Process::fake(function (PendingProcess $process) use (&$payloads) {
+        $payloads = array_merge($payloads, base64PayloadsInCommand($process->command));
+
+        return Process::result(errorOutput: 'tee: /artifacts/build-time.env: No such file or directory', exitCode: 1);
+    });
+
+    $exception = captureDeploymentException(fn () => invokeSensitiveFailureJobMethod($job, $reflection, 'save_buildtime_environment_variables'));
+
+    expect($payloads)->not->toBeEmpty();
+    expect($exception->getMessage())
+        ->toContain('[command hidden because it contains sensitive data]')
+        ->toContain('No such file or directory')
+        ->not->toContain(SENSITIVE_FAILURE_SECRET);
+    foreach ($payloads as $payload) {
+        expect($exception->getMessage())->not->toContain($payload);
+    }
+});
+
+it('keeps the command in the error message for failed commands that are not sensitive', function () {
+    [$job] = makeSensitiveCommandFailureJob();
+
+    Process::fake(['*' => Process::result(errorOutput: 'ls: cannot access: No such file or directory', exitCode: 2)]);
+
+    $exception = captureDeploymentException(fn () => $job->execute_remote_command([
+        'command' => 'ls /artifacts/harmless-missing-directory',
+        'hidden' => true,
+    ]));
+
+    expect($exception->getMessage())
+        ->toContain('Command execution failed (exit code 2): ls /artifacts/harmless-missing-directory')
+        ->toContain('No such file or directory')
+        ->not->toContain('[command hidden because it contains sensitive data]');
+});
+
+it('redacts locked values from the error output of failed commands', function () {
+    [$job] = makeSensitiveCommandFailureJob([
+        ['key' => 'LOCKED_SECRET', 'value' => SENSITIVE_FAILURE_SECRET, 'is_shown_once' => true],
+    ]);
+
+    Process::fake(['*' => Process::result(errorOutput: 'failed with value '.SENSITIVE_FAILURE_SECRET, exitCode: 1)]);
+
+    $exception = captureDeploymentException(fn () => $job->execute_remote_command([
+        'command' => 'harmless-command --flag',
+    ]));
+
+    expect($exception->getMessage())
+        ->toContain('harmless-command --flag')
+        ->toContain('failed with value '.REDACTED)
+        ->not->toContain(SENSITIVE_FAILURE_SECRET);
+});
+
+it('logs only the variable names of the .env files in development mode', function () {
+    config()->set('app.env', 'local');
+    [$job, $reflection, $queue] = makeSensitiveCommandFailureJob([
+        ['key' => 'APP_SECRET', 'value' => SENSITIVE_FAILURE_SECRET],
+    ]);
+
+    $ranCommands = [];
+    Process::fake(function (PendingProcess $process) use (&$ranCommands) {
+        $ranCommands[] = $process->command;
+
+        return Process::result(output: str_contains($process->command, 'cat ') ? 'APP_SECRET='.SENSITIVE_FAILURE_SECRET : '');
+    });
+
+    invokeSensitiveFailureJobMethod($job, $reflection, 'save_runtime_environment_variables');
+    invokeSensitiveFailureJobMethod($job, $reflection, 'save_buildtime_environment_variables');
+
+    $logEntries = collect(json_decode((string) $queue->fresh()->logs, true));
+    $keyListEntries = $logEntries->filter(fn (array $entry): bool => str_contains((string) $entry['output'], '[DEBUG] Variable names in'));
+
+    expect($keyListEntries)->toHaveCount(2)
+        ->each(fn ($entry) => $entry->hidden->toBeTrue()->output->toContain('APP_SECRET'));
+    expect($logEntries->pluck('output')->merge($logEntries->pluck('command'))->filter()->implode("\n"))
+        ->not->toContain('APP_SECRET='.SENSITIVE_FAILURE_SECRET)
+        ->not->toContain('APP_SECRET="'.SENSITIVE_FAILURE_SECRET);
+    expect(collect($ranCommands)->filter(fn (string $command): bool => str_contains($command, 'cat /artifacts/sensitive-failure/.env') || str_contains($command, 'cat '.ApplicationDeploymentJob::BUILD_TIME_ENV_PATH)))
+        ->toBeEmpty();
+});
+
+function setSensitiveFailureJobProperties(object $job, ReflectionClass $reflection, array $properties): void
+{
+    foreach ($properties as $property => $value) {
+        $reflectionProperty = $reflection->getProperty($property);
+        $reflectionProperty->setAccessible(true);
+        $reflectionProperty->setValue($job, $value);
+    }
+}
+
+it('hides the helper container command when build secrets are passed as environment flags', function () {
+    [$job, $reflection, $queue, $application] = makeSensitiveCommandFailureJob([
+        ['key' => 'BUILD_SECRET', 'value' => SENSITIVE_FAILURE_SECRET, 'is_runtime' => false],
+    ]);
+    $application->settings()->update(['use_build_secrets' => true]);
+    $server = readSensitiveFailureJobProperty($job, $reflection, 'server');
+    setSensitiveFailureJobProperties($job, $reflection, [
+        'application' => $application->fresh(),
+        'destination' => StandaloneDocker::forceCreate([
+            'name' => 'sensitive-failure-network',
+            'network' => 'sensitive-failure-network',
+            'server_id' => $server->id,
+        ]),
+    ]);
+
+    Process::fake(function (PendingProcess $process) {
+        if (str_contains($process->command, 'docker run -d')) {
+            return Process::result(errorOutput: 'docker: Error response from daemon: network not found.', exitCode: 125);
+        }
+
+        return Process::result(output: str_contains($process->command, 'echo $HOME') ? '/root' : 'NOK');
+    });
+
+    $exception = captureDeploymentException(fn () => invokeSensitiveFailureJobMethod($job, $reflection, 'prepare_builder_image'));
+
+    expect($exception->getMessage())
+        ->toContain('[command hidden because it contains sensitive data]')
+        ->toContain('network not found')
+        ->not->toContain(SENSITIVE_FAILURE_SECRET);
+    expect((string) $queue->fresh()->logs)->not->toContain(SENSITIVE_FAILURE_SECRET);
+});
+
+it('hides the Railpack prepare command that passes build-time values', function () {
+    [$job, $reflection, $queue, $application] = makeSensitiveCommandFailureJob([
+        ['key' => 'BUILD_SECRET', 'value' => SENSITIVE_FAILURE_SECRET, 'is_runtime' => false],
+    ]);
+    $application->update(['build_pack' => 'railpack']);
+    setSensitiveFailureJobProperties($job, $reflection, [
+        'application' => $application->fresh(),
+        'build_pack' => 'railpack',
+        'dockerBuildxAvailable' => true,
+    ]);
+
+    Process::fake(function (PendingProcess $process) {
+        if (str_contains($process->command, 'railpack prepare')) {
+            return Process::result(errorOutput: 'railpack: failed to detect a provider', exitCode: 1);
+        }
+
+        return Process::result(output: str_contains($process->command, 'buildx version') ? 'available' : 'missing');
+    });
+
+    $exception = captureDeploymentException(fn () => invokeSensitiveFailureJobMethod($job, $reflection, 'build_railpack_image'));
+
+    expect($exception->getMessage())
+        ->toContain('[command hidden because it contains sensitive data]')
+        ->toContain('failed to detect a provider')
+        ->not->toContain(SENSITIVE_FAILURE_SECRET);
+    expect((string) $queue->fresh()->logs)->not->toContain(SENSITIVE_FAILURE_SECRET);
+});
+
+it('hides the Nixpacks plan write command that contains build-time values', function (bool $isStatic) {
+    [$job, $reflection, $queue, $application] = makeSensitiveCommandFailureJob();
+    $application->update(['build_pack' => 'nixpacks']);
+    $application->settings()->update(['is_static' => $isStatic]);
+    setSensitiveFailureJobProperties($job, $reflection, [
+        'application' => $application->fresh(),
+        'build_pack' => 'nixpacks',
+        'build_args' => collect(),
+        'disableBuildCache' => false,
+        'force_rebuild' => false,
+        'nixpacks_plan' => json_encode(['variables' => ['BUILD_SECRET' => SENSITIVE_FAILURE_SECRET]]),
+    ]);
+
+    $payloads = [];
+    Process::fake(function (PendingProcess $process) use (&$payloads) {
+        $commandPayloads = base64PayloadsInCommand($process->command);
+        if ($commandPayloads !== []) {
+            $payloads = array_merge($payloads, $commandPayloads);
+
+            return Process::result(errorOutput: 'tee: /artifacts/thegameplan.json: No space left on device', exitCode: 1);
+        }
+
+        return Process::result();
+    });
+
+    $exception = captureDeploymentException(fn () => invokeSensitiveFailureJobMethod($job, $reflection, 'build_image'));
+
+    expect($payloads)->not->toBeEmpty();
+    expect($exception->getMessage())
+        ->toContain('[command hidden because it contains sensitive data]')
+        ->not->toContain(SENSITIVE_FAILURE_SECRET);
+    $storedLogs = (string) $queue->fresh()->logs;
+    foreach ($payloads as $payload) {
+        expect($exception->getMessage())->not->toContain($payload);
+        expect($storedLogs)->not->toContain($payload);
+    }
+})->with([
+    'static' => [true],
+    'not static' => [false],
+]);
+
+it('hides the compose file write command because compose files can contain secrets', function () {
+    [$job, $reflection, $queue, $application] = makeSensitiveCommandFailureJob();
+    $server = readSensitiveFailureJobProperty($job, $reflection, 'server');
+    setSensitiveFailureJobProperties($job, $reflection, [
+        'destination' => $server->standaloneDockers()->firstOrFail(),
+        'production_image_name' => 'example/app:latest',
+    ]);
+
+    $payloads = [];
+    Process::fake(function (PendingProcess $process) use (&$payloads) {
+        preg_match_all('~[A-Za-z0-9+/]{16,}={0,2}~', $process->command, $matches);
+        $composePayloads = array_filter($matches[0], fn (string $candidate): bool => str_contains((string) base64_decode($candidate, true), 'services:'));
+        if ($composePayloads !== []) {
+            $payloads = array_merge($payloads, $composePayloads);
+
+            return Process::result(errorOutput: 'tee: docker-compose.yaml: No space left on device', exitCode: 1);
+        }
+
+        return Process::result();
+    });
+
+    $exception = captureDeploymentException(fn () => invokeSensitiveFailureJobMethod($job, $reflection, 'generate_compose_file'));
+
+    expect($payloads)->not->toBeEmpty();
+    expect($exception->getMessage())
+        ->toContain('[command hidden because it contains sensitive data]')
+        ->toContain('No space left on device');
+    $storedLogs = (string) $queue->fresh()->logs;
+    foreach ($payloads as $payload) {
+        expect($exception->getMessage())->not->toContain($payload);
+        expect($storedLogs)->not->toContain($payload);
+    }
+});
+
+function readSensitiveFailureJobProperty(object $job, ReflectionClass $reflection, string $property): mixed
+{
+    $reflectionProperty = $reflection->getProperty($property);
+    $reflectionProperty->setAccessible(true);
+
+    return $reflectionProperty->getValue($job);
+}
diff --git a/tests/Feature/GitSourcePrivateNetworkTest.php b/tests/Feature/GitSourcePrivateNetworkTest.php
new file mode 100644
index 0000000000..cfaed850b2
--- /dev/null
+++ b/tests/Feature/GitSourcePrivateNetworkTest.php
@@ -0,0 +1,95 @@
+<?php
+
+use App\Models\InstanceSettings;
+use App\Rules\SafeExternalUrl;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Http;
+use Illuminate\Support\Facades\Validator;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::unguarded(fn () => InstanceSettings::query()->create(['id' => 0]));
+    config(['constants.coolify.self_hosted' => true]);
+});
+
+function gitSourceOptions(string $url, array $resolvedIps = ['203.0.113.10']): array
+{
+    return SafeExternalUrl::httpClientOptions($url, resolver: fn (string $host): array => $resolvedIps, allowPrivateNetworks: true);
+}
+
+function gitSourceUrlIsValid(string $url): bool
+{
+    return Validator::make(['api_url' => $url], ['api_url' => [SafeExternalUrl::forGitSource()]])->passes();
+}
+
+test('self-hosted Git sources can use private networks and internal hostnames', function (string $url, array $resolvedIps) {
+    $options = gitSourceOptions($url, $resolvedIps);
+
+    expect($options['allow_redirects'])->toBeFalse();
+})->with([
+    'RFC 1918 IP' => ['https://10.0.0.5/api/v3', []],
+    'private IP with port' => ['http://192.168.1.20:8929/api/v4', []],
+    'Tailscale CGNAT IP' => ['https://100.101.102.103/api/v4', []],
+    'IPv6 unique local address' => ['https://[fd12:3456::1]/api/v4', []],
+    'hostname on a private IP' => ['https://github.company.lan/api/v3', ['10.1.2.3']],
+    '.internal hostname' => ['https://gitlab.corp.internal/api/v4', ['172.16.5.4']],
+    '.local hostname' => ['https://gitea.local/api/v1', ['192.168.1.30']],
+    'single-label container name' => ['http://gitea:3000/api/v1', ['172.18.0.7']],
+    'Tailscale MagicDNS name' => ['https://git.tail1234.ts.net/api/v4', ['100.64.0.9']],
+]);
+
+test('the private-network mode pins the resolved private address', function () {
+    $options = gitSourceOptions('https://gitlab.corp.internal/api/v4', ['172.16.5.4']);
+
+    expect($options['curl'][CURLOPT_RESOLVE][0])->toBe('gitlab.corp.internal:443:172.16.5.4');
+});
+
+test('Git sources still cannot reach metadata, loopback, or reserved targets', function (string $url, array $resolvedIps) {
+    expect(fn () => gitSourceOptions($url, $resolvedIps))->toThrow(RuntimeException::class);
+})->with([
+    'cloud metadata IP' => ['http://169.254.169.254/latest', []],
+    'metadata hostname' => ['http://metadata.google.internal/computeMetadata', ['169.254.169.254']],
+    'IPv6 link-local' => ['http://[fe80::1]/', []],
+    'loopback IP' => ['http://127.0.0.1:6379/', []],
+    'IPv6 loopback' => ['http://[::1]/', []],
+    'localhost' => ['http://localhost:8080/', []],
+    'hostname on loopback' => ['https://git.example.com/', ['127.0.0.1']],
+    'unspecified address' => ['http://0.0.0.0/', []],
+    'IPv4-mapped metadata IP' => ['http://[::ffff:169.254.169.254]/', []],
+    'multicast' => ['http://224.0.0.1/', []],
+    'hostname with one private and one metadata IP' => ['https://git.example.com/', ['10.0.0.5', '169.254.169.254']],
+]);
+
+test('other outbound URLs still block private networks by default', function () {
+    expect(fn () => SafeExternalUrl::httpClientOptions('https://10.0.0.5/hook'))
+        ->toThrow(RuntimeException::class, 'unsafe IP address')
+        ->and(fn () => SafeExternalUrl::httpClientOptions('https://gitlab.corp.internal/', resolver: fn (): array => ['172.16.5.4']))
+        ->toThrow(RuntimeException::class);
+});
+
+test('the Git source HTTP client allows a private GitHub Enterprise on self-hosted', function () {
+    $options = Http::GitHub('https://10.20.30.40/api/v3', 'secret')->getOptions();
+
+    expect($options['allow_redirects'])->toBeFalse()
+        ->and($options['headers']['Authorization'])->toBe('Bearer secret');
+});
+
+test('the Git source HTTP client keeps private networks blocked on Coolify Cloud', function () {
+    config(['constants.coolify.self_hosted' => false]);
+
+    expect(fn () => Http::GitHub('https://10.20.30.40/api/v3', 'secret'))
+        ->toThrow(RuntimeException::class, 'unsafe IP address');
+});
+
+test('Git source URL validation follows the same private-network rules', function () {
+    expect(gitSourceUrlIsValid('https://10.20.30.40/api/v3'))->toBeTrue()
+        ->and(gitSourceUrlIsValid('https://100.101.102.103/api/v4'))->toBeTrue()
+        ->and(gitSourceUrlIsValid('http://169.254.169.254/latest'))->toBeFalse()
+        ->and(gitSourceUrlIsValid('http://127.0.0.1/'))->toBeFalse()
+        ->and(gitSourceUrlIsValid('http://localhost/'))->toBeFalse();
+
+    config(['constants.coolify.self_hosted' => false]);
+
+    expect(gitSourceUrlIsValid('https://10.20.30.40/api/v3'))->toBeFalse();
+});
diff --git a/tests/Feature/MobileResourceMenuTest.php b/tests/Feature/MobileResourceMenuTest.php
index d6f3177146..182d11f85f 100644
--- a/tests/Feature/MobileResourceMenuTest.php
+++ b/tests/Feature/MobileResourceMenuTest.php
@@ -1,6 +1,6 @@
 <?php
 
-it('uses the themed warning color for resource action icons', function () {
+it('uses neutral play icons for resource start actions', function () {
     foreach ([
         'application',
         'database',
@@ -8,150 +8,116 @@ it('uses the themed warning color for resource action icons', function () {
     ] as $resource) {
         $heading = file_get_contents(resource_path("views/livewire/project/{$resource}/heading.blade.php"));
 
-        expect(substr_count($heading, 'name="play-circle" class="size-3.5 text-warning"'))
+        // One neutral start icon in the mobile split action and one in the desktop split action.
+        expect(substr_count($heading, 'name="play-circle" class="size-3.5"'))
             ->toBeGreaterThanOrEqual(2);
+
+        expect($heading)
+            ->not->toContain('name="play-circle" class="size-3.5 text-warning"')
+            ->not->toContain('name="play-circle" class="size-3.5 text-orange-500');
     }
 });
 
-it('uses native mobile menus for databases and services', function () {
-    $applicationHeading = file_get_contents(resource_path('views/livewire/project/application/heading.blade.php'));
-    $databaseHeading = file_get_contents(resource_path('views/livewire/project/database/heading.blade.php'));
-    $serviceHeading = file_get_contents(resource_path('views/livewire/project/service/heading.blade.php'));
-    $applicationMobileActions = mobileActionsMarkup($applicationHeading, 'application-mobile-actions', 'application-mobile-section');
-    $databaseMobileActions = mobileActionsMarkup($databaseHeading, 'database-mobile-actions', 'database-mobile-section');
-    $serviceMobileActions = mobileActionsMarkup($serviceHeading, 'service-mobile-actions', 'service-mobile-section');
+it('uses full-width split action menus on mobile resource headings', function () {
+    $headings = [
+        'application' => file_get_contents(resource_path('views/livewire/project/application/heading.blade.php')),
+        'database' => file_get_contents(resource_path('views/livewire/project/database/heading.blade.php')),
+        'service' => file_get_contents(resource_path('views/livewire/project/service/heading.blade.php')),
+    ];
 
-    expect(mobileActionsAreBeforeSelect($applicationHeading, 'application-mobile-actions', 'application-mobile-section'))->toBeTrue();
-    expect(mobileActionsAreBeforeSelect($databaseHeading, 'database-mobile-actions', 'database-mobile-section'))->toBeTrue();
-    expect(mobileActionsAreBeforeSelect($serviceHeading, 'service-mobile-actions', 'service-mobile-section'))->toBeTrue();
+    foreach ($headings as $resource => $heading) {
+        expect(mobileActionsAreBeforeDesktopActions($heading, "{$resource}-mobile-actions", "{$resource}-desktop-actions"))->toBeTrue();
 
-    expect($applicationHeading)
-        ->toContain('application-mobile-actions')
-        ->toContain("'route' => 'project.application.command'")
-        ->toContain("'navigate' => false")
-        ->toContain("value.startsWith('location|')")
-        ->toContain('window.location.href = url')
-        ->toContain('application-mobile-stop-trigger')
-        ->toContain('application-mobile-restart-trigger')
+        expect($heading)
+            ->toContain('<div class="w-full xl:hidden">')
+            ->toContain("<x-split-action id=\"{$resource}-mobile-actions\" class=\"mb-3 flex w-full\">")
+            ->not->toContain("{$resource}-mobile-section")
+            ->not->toContain('<select')
+            ->not->toContain('<optgroup')
+            ->not->toContain('@selected');
+
+        expect(mobileActionsMarkup($heading, "{$resource}-mobile-actions"))
+            ->toContain('<x-slot:main')
+            ->toContain('listbox-option justify-start! gap-2.5!')
+            ->toContain('role="menuitem"')
+            ->toContain('name="play-circle" class="size-3.5"')
+            ->toContain('name="restart" class="size-3.5')
+            ->toContain('name="stop-circle" class="size-3.5 text-error"');
+    }
+
+    expect(mobileActionsMarkup($headings['application'], 'application-mobile-actions'))
         ->toContain('wire:click="deploy"')
-        ->toContain('wire:click="force_deploy_without_cache"')
+        ->toContain('wire:click="deploy(true)"')
+        ->toContain('force_deploy_without_cache')
+        ->toContain('Deploy (without cache)')
+        ->toContain("document.getElementById('application-mobile-stop-trigger')?.click()")
+        ->toContain("document.getElementById('application-mobile-restart-trigger')?.click()");
+
+    expect($headings['application'])
+        ->toContain('<button id="application-mobile-stop-trigger" type="button">')
+        ->toContain('<button id="application-mobile-restart-trigger" type="button">')
         ->not->toContain('application-mobile-deploy-trigger')
         ->not->toContain('application-mobile-force-deploy-trigger')
-        ->not->toContain('Confirm Application Deployment?')
-        ->not->toContain('<optgroup label="Actions">');
+        ->not->toContain('Confirm Application Deployment?');
 
-    expect($applicationMobileActions)
-        ->toContain('mb-3')
-        ->toContain('Actions')
-        ->toContain('<x-forms.button isError class="shrink-0"')
-        ->not->toContain('button type="button" class="button shrink-0 text-error"')
-        ->toContain('M7 4v16l13 -8z')
-        ->toContain('M19.933 13.041a8 8 0 1 1-9.925-8.788c3.899-1 7.935 1.007 9.425 4.747')
-        ->toContain('M6 5m0 1a1 1 0 0 1 1 -1h2');
+    expect(mobileActionsMarkup($headings['database'], 'database-mobile-actions'))
+        ->toContain('x-bind:disabled="busy"')
+        ->toContain("document.getElementById('database-restart-trigger')?.click()")
+        ->toContain("document.getElementById('database-stop-trigger')?.click()")
+        ->toContain("\$wire.dispatch('startEvent')");
 
-    expect($applicationHeading)
-        ->toContain('application-mobile-section-label')
-        ->toContain('Section');
-
-    expect($databaseHeading)
-        ->toContain('database-mobile-section')
-        ->toContain('database-mobile-actions')
-        ->toContain('<optgroup label="Database">')
-        ->toContain('<optgroup label="Configuration">')
-        ->toContain("'route' => 'project.database.command'")
-        ->toContain("'navigate' => false")
-        ->toContain("value.startsWith('location|')")
-        ->toContain('window.location.href = url')
-        ->toContain('window.Livewire?.navigate ? window.Livewire.navigate(url) : window.location.href = url')
-        ->toContain("window.Livewire?.hook?.('morphed'")
-        ->toContain('x-model="selected"')
-        ->toContain('database-restart-trigger')
-        ->toContain('database-stop-trigger')
-        ->toContain("\$wire.dispatch('startEvent')")
+    expect($headings['database'])
+        ->toContain('<button id="database-restart-trigger" type="button">')
+        ->toContain('<button id="database-stop-trigger" type="button">')
         ->not->toContain('database-start-trigger')
-        ->not->toContain('Confirm Database Start?')
-        ->toContain('scrollbar hidden min-h-10')
-        ->not->toContain('<optgroup label="Links">')
-        ->not->toContain('<optgroup label="Actions">')
-        ->not->toContain('@selected');
+        ->not->toContain('Confirm Database Start?');
 
-    expect($databaseMobileActions)
-        ->toContain('mb-3')
-        ->toContain('Actions')
-        ->toContain('<x-forms.button isError class="shrink-0"')
-        ->not->toContain('button type="button" class="button shrink-0 text-error"')
-        ->toContain('M7 4v16l13 -8z')
-        ->toContain('M19.933 13.041a8 8 0 1 1-9.925-8.788c3.899-1 7.935 1.007 9.425 4.747')
-        ->toContain('M6 5m0 1a1 1 0 0 1 1 -1h2');
-
-    expect($databaseHeading)
-        ->toContain('database-mobile-section-label')
-        ->toContain('Section');
-
-    expect($serviceHeading)
-        ->toContain('service-mobile-section')
-        ->toContain('service-mobile-actions')
-        ->toContain('<optgroup label="Service">')
-        ->toContain('<optgroup label="Configuration">')
-        ->toContain('<optgroup label="Resource">')
-        ->toContain('<optgroup label="Links">')
-        ->toContain("'route' => 'project.service.command'")
-        ->toContain("'navigate' => false")
-        ->toContain("value.startsWith('location|')")
-        ->toContain('window.location.href = url')
-        ->toContain('window.Livewire?.navigate ? window.Livewire.navigate(url) : window.location.href = url')
-        ->toContain("window.Livewire?.hook?.('morphed'")
-        ->toContain('x-model="selected"')
-        ->toContain('service-restart-trigger')
-        ->toContain('service-stop-trigger')
+    expect(mobileActionsMarkup($headings['service'], 'service-mobile-actions'))
+        ->toContain('x-bind:disabled="deploying"')
+        ->toContain("document.getElementById('service-restart-trigger')?.click()")
+        ->toContain("document.getElementById('service-stop-trigger')?.click()")
         ->toContain("\$wire.dispatch('startEvent')")
         ->toContain("\$wire.dispatch('forceDeployEvent')")
-        ->toContain('service-pullAndRestart-trigger')
+        ->toContain("\$wire.dispatch('pullAndRestartEvent')");
+
+    expect($headings['service'])
+        ->toContain('<button id="service-restart-trigger" type="button">')
+        ->toContain('<button id="service-stop-trigger" type="button">')
         ->not->toContain('service-start-trigger')
         ->not->toContain('service-forceDeploy-trigger')
+        ->not->toContain('service-pullAndRestart-trigger')
         ->not->toContain('Confirm Service Deployment?')
-        ->not->toContain('Confirm Service Force Deployment?')
-        ->toContain('scrollbar hidden min-h-10')
-        ->toContain('mb-4 w-full md:mb-0 md:hidden')
-        ->toContain('hidden flex-wrap items-center gap-2 md:flex')
-        ->toContain('flex flex-nowrap')
-        ->toContain('overflow-x-auto')
-        ->not->toContain('<optgroup label="Actions">')
-        ->not->toContain('order-first flex flex-wrap items-center gap-2 sm:order-last')
-        ->not->toContain('@selected');
-
-    expect($serviceMobileActions)
-        ->toContain('mb-3')
-        ->toContain('Actions')
-        ->toContain('<x-forms.button isError class="shrink-0"')
-        ->not->toContain('button type="button" class="button shrink-0 text-error"')
-        ->toContain('M7 4v16l13 -8z')
-        ->toContain('M19.933 13.041a8 8 0 1 1-9.925-8.788c3.899-1 7.935 1.007 9.425 4.747')
-        ->toContain('M6 5m0 1a1 1 0 0 1 1 -1h2');
-
-    expect($serviceHeading)
-        ->toContain('service-mobile-section-label')
-        ->toContain('Section');
+        ->not->toContain('Confirm Service Force Deployment?');
 });
 
-function mobileActionsMarkup(string $heading, string $actionsId, string $selectId): string
+function mobileActionsMarkup(string $heading, string $actionsId): string
 {
     $actionsPosition = strpos($heading, 'id="'.$actionsId.'"');
-    $selectPosition = strpos($heading, 'id="'.$selectId.'"');
 
-    if ($actionsPosition === false || $selectPosition === false || $actionsPosition > $selectPosition) {
+    if ($actionsPosition === false) {
         return '';
     }
 
-    return substr($heading, $actionsPosition, $selectPosition - $actionsPosition);
+    $endPosition = strpos($heading, '</x-split-action>', $actionsPosition);
+
+    if ($endPosition === false) {
+        return '';
+    }
+
+    return substr($heading, $actionsPosition, $endPosition - $actionsPosition);
 }
 
-function mobileActionsAreBeforeSelect(string $heading, string $actionsId, string $selectId): bool
+function mobileActionsAreBeforeDesktopActions(string $heading, string $mobileActionsId, string $desktopActionsId): bool
 {
-    $actionsPosition = strpos($heading, 'id="'.$actionsId.'"');
-    $selectPosition = strpos($heading, 'id="'.$selectId.'"');
+    $mobilePosition = strpos($heading, 'id="'.$mobileActionsId.'"');
+    $hudPosition = strpos($heading, "@teleport('#resource-action-hud-slot')");
+    $desktopPosition = strpos($heading, 'id="'.$desktopActionsId.'"');
 
-    return $actionsPosition !== false && $selectPosition !== false && $actionsPosition < $selectPosition;
+    return $mobilePosition !== false
+        && $hudPosition !== false
+        && $desktopPosition !== false
+        && $mobilePosition < $hudPosition
+        && $hudPosition < $desktopPosition;
 }
 
 it('places database backups immediately after configuration in navigation menus', function () {
@@ -167,81 +133,59 @@ it('places database backups immediately after configuration in navigation menus'
     }
 });
 
-it('keeps configuration sidebars hidden until desktop breakpoint', function () {
+it('shows configuration sidebars as a mobile link grid and a desktop rail instead of native selects', function () {
     expect(file_get_contents(resource_path('views/livewire/project/database/configuration.blade.php')))
-        ->toContain('sub-menu-wrapper hidden md:flex');
+        ->toContain('<x-database.configuration-sidebar :database="$database" :current-route="$currentRoute" />')
+        ->toContain('xl:grid-cols-[210px_minmax(0,1fr)]')
+        ->not->toContain('sub-menu-wrapper');
 
-    expect(file_get_contents(resource_path('views/livewire/project/service/configuration.blade.php')))
-        ->toContain('sub-menu-wrapper hidden md:flex');
+    foreach ([
+        'views/components/database/configuration-sidebar.blade.php',
+        'views/livewire/project/service/configuration.blade.php',
+        'views/livewire/project/service/index.blade.php',
+        'views/components/service-database/sidebar.blade.php',
+        'views/components/server/sidebar.blade.php',
+        'views/components/server/sidebar-proxy.blade.php',
+        'views/components/server/sidebar-sentinel.blade.php',
+        'views/components/server/sidebar-security.blade.php',
+    ] as $view) {
+        expect(file_get_contents(resource_path($view)))
+            ->toContain('<aside class="application-settings-navigation min-w-0 xl:self-start"')
+            ->toContain('class="grid grid-cols-2 gap-0.5 border-y border-neutral-200 py-3')
+            ->toContain('xl:grid-cols-1 xl:border-y-0 xl:py-0')
+            ->not->toContain('sub-menu-wrapper')
+            ->not->toContain('<select')
+            ->not->toContain('<optgroup');
+    }
 
-    expect(file_get_contents(resource_path('views/livewire/project/service/index.blade.php')))
-        ->toContain('sub-menu-wrapper hidden md:flex');
-
-    expect(file_get_contents(resource_path('views/components/service-database/sidebar.blade.php')))
-        ->toContain('sub-menu-wrapper hidden md:flex');
-
-    $serverSidebar = file_get_contents(resource_path('views/components/server/sidebar.blade.php'));
-
-    expect($serverSidebar)
-        ->toContain('server-mobile-section-label')
-        ->toContain('server-mobile-section')
-        ->toContain('Section')
-        ->toContain('select w-full')
-        ->toContain('aria-label="Server menu"')
-        ->toContain('border-b-2 border-solid border-neutral-200 pb-4 md:hidden dark:border-coolgray-200')
-        ->toContain('<optgroup label="Server">')
-        ->toContain('<optgroup label="Configuration">')
+    expect(file_get_contents(resource_path('views/components/server/sidebar.blade.php')))
+        ->toContain('aria-label="Server configuration sections"')
         ->toContain("'route' => 'server.proxy'")
-        ->toContain("'navigate' => false")
-        ->toContain("value.startsWith('location|')")
-        ->toContain('window.Livewire?.navigate ? window.Livewire.navigate(url) : window.location.href = url')
-        ->toContain('x-on:livewire:navigated.window="syncFromLocation()"')
-        ->toContain('sub-menu-wrapper hidden md:flex')
-        ->not->toContain('sub-menu-wrapper">');
+        ->toContain("'navigate' => false");
 
     $serverNavbar = file_get_contents(resource_path('views/livewire/server/navbar.blade.php'));
 
     expect($serverNavbar)
-        ->toContain('server-mobile-actions')
-        ->toContain('Actions')
-        ->toContain('pb-0 md:pb-6')
-        ->toContain('navbar-main')
-        ->toContain('server-mobile-actions" class="mt-2 mb-3')
-        ->toContain('hidden min-h-10')
-        ->toContain('md:flex')
-        ->toContain('md:hidden')
-        ->toContain('flex flex-nowrap gap-2 overflow-x-auto')
-        ->toContain('server-mobile-restart-proxy-trigger')
-        ->toContain('server-mobile-stop-proxy-trigger')
-        ->toContain('class="button shrink-0"')
-        ->toContain('hidden gap-2 md:flex');
+        ->toContain('<div class="mb-3 w-full lg:hidden">')
+        ->toContain('<div class="w-full xl:hidden">')
+        ->toContain('<x-split-action id="server-mobile-actions" class="mb-3 flex w-full">')
+        ->toContain('<button id="server-mobile-restart-proxy-trigger" type="button">')
+        ->toContain('<button id="server-mobile-stop-proxy-trigger" type="button">')
+        ->not->toContain('navbar-main')
+        ->not->toContain('<select');
 
     $serverMobileActions = serverMobileActionsMarkup($serverNavbar);
 
+    expect($serverMobileActions)
+        ->toContain('Restart Proxy')
+        ->toContain('Stop Proxy')
+        ->toContain('Refresh Proxy Status')
+        ->not->toContain('Traefik');
+
     expect(strpos($serverMobileActions, 'Restart Proxy'))
         ->toBeLessThan(strpos($serverMobileActions, 'Stop Proxy'))
-        ->toBeLessThan(strpos($serverMobileActions, 'Traefik Dashboard'));
-
-    foreach ([
-        'views/components/server/sidebar-proxy.blade.php' => 'Proxy menu',
-        'views/components/server/sidebar-sentinel.blade.php' => 'Sentinel menu',
-        'views/components/server/sidebar-security.blade.php' => 'Security menu',
-    ] as $view => $label) {
-        $sidebar = file_get_contents(resource_path($view));
-
-        expect($sidebar)
-            ->toContain('server-mobile-section-label')
-            ->toContain('server-mobile-section')
-            ->toContain('Section')
-            ->toContain('select w-full')
-            ->toContain('aria-label="'.$label.'"')
-            ->toContain('border-b-2 border-solid border-neutral-200 pb-4 md:hidden dark:border-coolgray-200')
-            ->toContain('<optgroup label="Server">')
-            ->toContain('window.Livewire?.navigate ? window.Livewire.navigate(url) : window.location.href = url')
-            ->toContain('x-on:livewire:navigated.window="syncFromLocation()"')
-            ->toContain('sub-menu-wrapper hidden md:flex')
-            ->not->toContain('sub-menu-wrapper">');
-    }
+        ->and(strpos($serverMobileActions, 'Stop Proxy'))
+        ->toBeLessThan(strpos($serverMobileActions, 'Refresh Proxy Status'));
 
     foreach ([
         'views/livewire/server/show.blade.php',
@@ -265,9 +209,10 @@ it('keeps configuration sidebars hidden until desktop breakpoint', function () {
         'views/livewire/server/security/terminal-access.blade.php',
     ] as $view) {
         expect(file_get_contents(resource_path($view)))
-            ->toContain('gap-4 md:gap-8 md:flex-row')
-            ->toContain('md:flex-row')
-            ->not->toContain('sm:flex-row')
+            ->toContain('server-settings-workspace application-settings-workspace')
+            ->toContain('xl:grid-cols-[210px_minmax(0,1fr)]')
+            ->toContain('<x-server.sidebar')
+            ->not->toContain('sub-menu-wrapper')
             ->not->toContain('class="flex flex-col h-full gap-8 md:flex-row');
     }
 });
diff --git a/tests/Feature/Proxy/LegacyTraefikDashboardLabelsTest.php b/tests/Feature/Proxy/LegacyTraefikDashboardLabelsTest.php
new file mode 100644
index 0000000000..dc8fefc3af
--- /dev/null
+++ b/tests/Feature/Proxy/LegacyTraefikDashboardLabelsTest.php
@@ -0,0 +1,169 @@
+<?php
+
+use App\Actions\Proxy\GetProxyConfiguration;
+use App\Enums\ProxyTypes;
+use App\Models\InstanceSettings;
+use App\Models\Server;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Livewire\Livewire;
+use Symfony\Component\Yaml\Yaml;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    $this->withoutDefer();
+    InstanceSettings::forceCreate(['id' => 0]);
+});
+
+/**
+ * The Traefik configuration that Coolify generated before the dashboard exposure fix.
+ */
+function legacyTraefikConfiguration(array $extraLabels = [], bool $swarm = false): string
+{
+    $labels = [
+        'traefik.enable=true',
+        'traefik.http.routers.traefik.entrypoints=http',
+        'traefik.http.routers.traefik.service=api@internal',
+        'traefik.http.services.traefik.loadbalancer.server.port=8080',
+        'coolify.managed=true',
+        'coolify.proxy=true',
+        ...$extraLabels,
+    ];
+    $service = [
+        'image' => 'traefik:v3.6',
+        'ports' => ['80:80', '443:443', '8080:8080'],
+        'command' => ['--api.dashboard=true', '--api.insecure=false', '--providers.docker.exposedbydefault=false'],
+    ];
+    if ($swarm) {
+        $service['deploy'] = ['labels' => $labels];
+    } else {
+        $service['container_name'] = 'coolify-proxy';
+        $service['labels'] = $labels;
+    }
+
+    return "# my custom comment\n".Yaml::dump(['name' => 'coolify-proxy', 'services' => ['traefik' => $service]], 10, 2);
+}
+
+function traefikServerWithConfiguration(string $configuration, bool $applied = true): Server
+{
+    $server = Server::factory()->create(['team_id' => Team::factory()->create()->id]);
+    $server->proxy->type = ProxyTypes::TRAEFIK->value;
+    $server->proxy->status = 'running';
+    $server->proxy->last_saved_proxy_configuration = $configuration;
+    $server->proxy->last_saved_settings = md5(base64_encode($configuration));
+    $server->proxy->last_applied_settings = $applied ? $server->proxy->last_saved_settings : null;
+    $server->save();
+
+    return $server->fresh();
+}
+
+test('the legacy dashboard router labels are replaced with traefik.enable=false', function (bool $swarm) {
+    $configuration = legacyTraefikConfiguration(swarm: $swarm);
+
+    $fixed = removeLegacyTraefikDashboardLabels($configuration);
+    $labels = data_get(Yaml::parse($fixed), $swarm ? 'services.traefik.deploy.labels' : 'services.traefik.labels');
+
+    expect($labels)->toBe(['traefik.enable=false', 'coolify.managed=true', 'coolify.proxy=true'])
+        ->and($fixed)->toContain('# my custom comment')
+        ->and($fixed)->not->toContain('api@internal')
+        ->and(removeLegacyTraefikDashboardLabels($fixed))->toBe($fixed);
+})->with(['standalone' => false, 'swarm' => true]);
+
+test('quoted legacy labels are also replaced', function () {
+    $configuration = str_replace(
+        ['- traefik.enable=true', '- traefik.http.routers.traefik.service=api@internal'],
+        ["- 'traefik.enable=true'", '- "traefik.http.routers.traefik.service=api@internal"'],
+        legacyTraefikConfiguration(),
+    );
+
+    $labels = data_get(Yaml::parse(removeLegacyTraefikDashboardLabels($configuration)), 'services.traefik.labels');
+
+    expect($labels)->toBe(['traefik.enable=false', 'coolify.managed=true', 'coolify.proxy=true']);
+});
+
+test('a dashboard router that the user changed is kept', function (array $extraLabels) {
+    $configuration = legacyTraefikConfiguration($extraLabels);
+
+    expect(removeLegacyTraefikDashboardLabels($configuration))->toBe($configuration);
+})->with([
+    'custom rule' => [['traefik.http.routers.traefik.rule=Host(`traefik.example.com`)']],
+    'auth middleware' => [['traefik.http.routers.traefik.middlewares=auth']],
+    'other router on the proxy' => [['traefik.http.routers.other.rule=Host(`other.example.com`)']],
+]);
+
+test('configurations without the legacy dashboard router are not changed', function () {
+    $configuration = Yaml::dump(['services' => ['traefik' => ['labels' => ['traefik.enable=false', 'coolify.managed=true', 'coolify.proxy=true']]]], 10, 2);
+
+    expect(removeLegacyTraefikDashboardLabels($configuration))->toBe($configuration)
+        ->and(removeLegacyTraefikDashboardLabels("services:\n  traefik: [\n"))->toBe("services:\n  traefik: [\n");
+});
+
+test('loading a legacy configuration saves the fix and marks the proxy for restart', function () {
+    $server = traefikServerWithConfiguration(legacyTraefikConfiguration());
+    expect($server->hasPendingProxyConfiguration())->toBeFalse();
+
+    $configuration = GetProxyConfiguration::run($server);
+
+    $server->refresh();
+    expect($configuration)->not->toContain('api@internal')
+        ->and($server->proxy->last_saved_proxy_configuration)->toBe($configuration)
+        ->and($server->proxy->last_saved_settings)->toBe(md5(base64_encode($configuration)))
+        ->and($server->hasPendingProxyConfiguration())->toBeTrue();
+});
+
+test('the fix marks a running proxy for restart when no applied settings were recorded', function () {
+    $legacy = legacyTraefikConfiguration();
+    $server = traefikServerWithConfiguration($legacy, applied: false);
+
+    GetProxyConfiguration::run($server);
+
+    $server->refresh();
+    expect($server->proxy->last_applied_settings)->toBe(md5(base64_encode($legacy)))
+        ->and($server->hasPendingProxyConfiguration())->toBeTrue();
+});
+
+test('the migration fixes saved legacy configurations without connecting to servers', function () {
+    $legacy = traefikServerWithConfiguration(legacyTraefikConfiguration());
+    $custom = traefikServerWithConfiguration(legacyTraefikConfiguration(['traefik.http.routers.traefik.middlewares=auth']));
+    $caddy = Server::factory()->create(['team_id' => Team::factory()->create()->id]);
+    $caddy->proxy->type = ProxyTypes::CADDY->value;
+    $caddy->proxy->last_saved_proxy_configuration = 'services: {}';
+    $caddy->save();
+
+    (require database_path('migrations/2026_09_25_210000_remove_legacy_traefik_dashboard_labels.php'))->up();
+
+    expect($legacy->fresh()->proxy->last_saved_proxy_configuration)->not->toContain('api@internal')
+        ->and($legacy->fresh()->hasPendingProxyConfiguration())->toBeTrue()
+        ->and($custom->fresh()->proxy->last_saved_proxy_configuration)->toContain('api@internal')
+        ->and($custom->fresh()->hasPendingProxyConfiguration())->toBeFalse()
+        ->and($caddy->fresh()->proxy->last_saved_proxy_configuration)->toBe('services: {}');
+});
+
+test('the migration saves each server outside one shared transaction', function () {
+    // In Postgres one failed update aborts a shared transaction, so later servers could not be saved.
+    $migration = require database_path('migrations/2026_09_25_210000_remove_legacy_traefik_dashboard_labels.php');
+
+    expect($migration->withinTransaction)->toBeFalse();
+});
+
+test('the pending proxy notice asks the user to restart the proxy', function () {
+    $team = Team::factory()->create();
+    $user = User::factory()->create();
+    $user->teams()->attach($team, ['role' => 'admin']);
+    $server = Server::factory()->create(['team_id' => $team->id]);
+    $server->settings()->update(['is_reachable' => true, 'is_usable' => true]);
+    $server->proxy->type = ProxyTypes::TRAEFIK->value;
+    $server->proxy->status = 'running';
+    $server->proxy->last_saved_settings = 'new-hash';
+    $server->proxy->last_applied_settings = 'old-hash';
+    $server->save();
+
+    $this->actingAs($user);
+    session(['currentTeam' => $team]);
+
+    Livewire::test('server.navbar', ['server' => $server->fresh()])
+        ->assertSee('Your configuration changed, please restart the proxy.')
+        ->assertDontSee('The saved proxy configuration has not been applied');
+});
diff --git a/tests/Feature/Proxy/RestartProxyTest.php b/tests/Feature/Proxy/RestartProxyTest.php
index 0c393c03b5..c554d9cf15 100644
--- a/tests/Feature/Proxy/RestartProxyTest.php
+++ b/tests/Feature/Proxy/RestartProxyTest.php
@@ -97,7 +97,7 @@ test('running proxy shows pending configuration warning when saved settings diff
 
     $component = Livewire::test('server.navbar', ['server' => $server->fresh()])
         ->assertSee('Changes pending')
-        ->assertSee('The saved proxy configuration has not been applied')
+        ->assertSee('Your configuration changed, please restart the proxy.')
         ->assertSee('Restart proxy');
 
     $server->refresh();
@@ -107,7 +107,7 @@ test('running proxy shows pending configuration warning when saved settings diff
 
     $component->call('showNotification')
         ->assertDispatched('proxy-configuration-state-changed', pending: false, traefikOutdated: false)
-        ->assertDontSee('The saved proxy configuration has not been applied');
+        ->assertDontSee('Your configuration changed, please restart the proxy.');
 });
 
 test('running proxy hides pending configuration warning when saved settings match applied settings', function () {
@@ -123,7 +123,7 @@ test('running proxy hides pending configuration warning when saved settings matc
     session(['currentTeam' => $team]);
 
     $component = Livewire::test('server.navbar', ['server' => $server->fresh()])
-        ->assertDontSee('The saved proxy configuration has not been applied');
+        ->assertDontSee('Your configuration changed, please restart the proxy.');
 
     $server->refresh();
     $server->proxy->last_saved_settings = 'new-saved-hash';
@@ -132,7 +132,27 @@ test('running proxy hides pending configuration warning when saved settings matc
     $component->dispatch('refreshServerShow')
         ->assertDispatched('proxy-configuration-state-changed', pending: true, traefikOutdated: false)
         ->assertSee('Changes pending')
-        ->assertSee('The saved proxy configuration has not been applied');
+        ->assertSee('Your configuration changed, please restart the proxy.');
+});
+
+test('navbar tells the sidebar when the proxy is not running', function () {
+    [$user, $team, $server] = setupProxyUser('admin');
+    makeServerProxyRunning($server);
+
+    $this->actingAs($user);
+    session(['currentTeam' => $team]);
+
+    $component = Livewire::test('server.navbar', ['server' => $server->fresh()]);
+
+    $component->call('showNotification')
+        ->assertDispatched('proxy-configuration-state-changed', proxyNotRunning: false);
+
+    $server->refresh();
+    $server->proxy->status = 'exited';
+    $server->save();
+
+    $component->call('showNotification')
+        ->assertDispatched('proxy-configuration-state-changed', proxyNotRunning: true);
 });
 
 test('admin can stop a proxy while it is starting', function () {
@@ -186,10 +206,24 @@ test('start proxy button shows a loading state while proxy startup actions run',
     $this->actingAs($user);
     session(['currentTeam' => $team]);
 
-    Livewire::test('server.navbar', ['server' => $mock])
+    $html = Livewire::test('server.navbar', ['server' => $mock])
         ->assertSeeHtml('wire:loading.attr="disabled"')
-        ->assertSeeHtml('wire:loading.class="is-loading"')
-        ->assertSeeHtml('wire:target="checkProxy,startProxy"');
+        ->assertSeeHtml('wire:target="checkProxy,startProxy"')
+        ->html();
+
+    // The split action main button shows its loading state through the
+    // `.split-action-main:disabled` style while Livewire disables it.
+    preg_match_all('/<button\b[^>]*class="split-action-main"[^>]*>(?:(?!<\/button>).)*?Start Proxy/s', $html, $startButtons);
+
+    expect($startButtons[0])->not->toBeEmpty();
+    foreach ($startButtons[0] as $startButton) {
+        expect($startButton)
+            ->toContain('wire:loading.attr="disabled"')
+            ->toContain('wire:target="checkProxy,startProxy"');
+    }
+
+    expect(file_get_contents(resource_path('css/app.css')))
+        ->toMatch('/\.split-action-main:disabled,\s*\.split-action-caret:disabled\s*\{[^}]*opacity:/');
 });
 
 test('starting a proxy records a team audit event', function () {
diff --git a/tests/Feature/RealtimeTerminalPackagingTest.php b/tests/Feature/RealtimeTerminalPackagingTest.php
index 4c4872f0d5..3b678a7a8b 100644
--- a/tests/Feature/RealtimeTerminalPackagingTest.php
+++ b/tests/Feature/RealtimeTerminalPackagingTest.php
@@ -143,7 +143,7 @@ it('shows connection progress in the terminal body instead of the header', funct
         ->not->toContain('wire:loading.flex wire:target="selected_container,connectToContainer"')
         ->not->toContain('wire:loading.flex wire:target="selected_uuid,connectToContainer"')
         ->and($terminalView)
-        ->toContain("x-on:terminal-starting.window=\"starting = true; setTerminalTheme(localStorage.getItem('coolify-console-theme') ?? 'system')\"")
+        ->toContain("x-on:terminal-starting.window=\"beginTerminalSessionStart(); setTerminalTheme(localStorage.getItem('coolify-console-theme') ?? 'system')\"")
         ->toContain('data-auto-start="{{ $autoStart ? \'true\' : \'false\' }}"')
         ->toContain("starting ? 'connecting…'")
         ->and($terminalClient)
@@ -578,3 +578,58 @@ it('fits the terminal with FitAddon and keeps xterm within the host after resize
         ->toContain('scrollback: 5000')
         ->not->toContain('Math.floor(height / charSize.height) - 1');
 });
+
+it('reports terminal authentication rejections with readable WebSocket close codes', function () {
+    $terminalServer = file_get_contents(base_path('docker/coolify-terminal/terminal-server.js'));
+    $terminalUtils = file_get_contents(base_path('docker/coolify-terminal/terminal-utils.js'));
+
+    expect($terminalUtils)
+        ->toContain('AUTH_REJECTED: 4401')
+        ->toContain('TOKEN_REJECTED: 4403')
+        ->and($terminalServer)
+        ->toContain("new WebSocketServer({ noServer: true, path: '/terminal/ws' })")
+        ->toContain("server.on('upgrade', createTerminalUpgradeHandler({ wss, authenticate: verifyClient }))")
+        ->toContain("rejectTerminalToken(userSession, 'Unauthorized: Invalid terminal token')")
+        ->toContain("rejectTerminalToken(userSession, 'Unauthorized: Terminal token was rejected')")
+        ->toContain("typeof token !== 'string' || !/^[a-zA-Z0-9]{64}$/.test(token)")
+        ->toContain("response.status !== 200 || typeof response.data?.command !== 'string'")
+        ->not->toContain('verifyClient: verifyClient')
+        ->not->toContain('ws.close(401');
+});
+
+it('leaves the terminal connecting state when the connection is rejected, lost, or times out', function () {
+    $terminalClient = file_get_contents(resource_path('js/terminal.js'));
+    $terminalView = file_get_contents(resource_path('views/livewire/project/shared/terminal.blade.php'));
+
+    expect($terminalClient)
+        ->toContain("from './terminal-connection.js'")
+        ->toContain('connectionError: null')
+        ->toContain('const outcome = resolveTerminalCloseOutcome({')
+        ->toContain('this.authRejected = true;')
+        ->toContain('if (this.authRejected) {')
+        ->toContain('Ignoring terminal token after authentication was rejected.')
+        ->toContain('failTerminalConnection(TERMINAL_CONNECTION_ERRORS.timeout)')
+        ->toContain('failTerminalConnection(TERMINAL_CONNECTION_ERRORS.connectionFailed)')
+        ->toContain('...terminalSessionStartMethods,')
+        ->toContain('this.beginTerminalSessionStart();')
+        ->and(file_get_contents(resource_path('js/terminal-connection.js')))
+        ->toContain('export const terminalSessionStartMethods = {')
+        ->toContain('}, TERMINAL_SESSION_START_TIMEOUT_MS);')
+        ->and($terminalView)
+        ->toContain('data-terminal-connection-error')
+        ->toContain('x-text="connectionError"')
+        ->toContain('x-on:click="reloadTerminalPage()"')
+        ->toContain('x-show="!connectionError" class="terminal-loading-label');
+});
+
+it('ends the auto-start connecting state when no terminal token arrives', function () {
+    $terminalClient = file_get_contents(resource_path('js/terminal.js'));
+
+    expect($terminalClient)
+        ->toMatch("/this\.starting = this\.\\\$el\.dataset\.autoStart === 'true';.*?if \(this\.starting\) \{\s*this\.armTerminalSessionStartTimeout\(\);\s*\}/s")
+        ->toContain("this.\$wire.on('terminal-session-failed', ({ message }) => {")
+        ->toContain('this.failTerminalSessionStart(message);')
+        ->toContain("this.\$wire.on('terminal-auto-start-cancelled', () => {")
+        ->toMatch('/destroy\(\) \{\s*this\.clearSessionStartTimeout\(\);/')
+        ->toMatch("/event\.data === 'pty-ready'\) \{\s*this\.completeTerminalSessionStart\(\);/");
+});
diff --git a/tests/Feature/ResourceHeadingUnifiedNavbarTest.php b/tests/Feature/ResourceHeadingUnifiedNavbarTest.php
index 6af19d4ed6..e68b9fde7f 100644
--- a/tests/Feature/ResourceHeadingUnifiedNavbarTest.php
+++ b/tests/Feature/ResourceHeadingUnifiedNavbarTest.php
@@ -505,10 +505,15 @@ it('keeps the application settings sidebar below the fixed header while scrollin
     $sidebar = file_get_contents(resource_path('views/components/application/configuration-sidebar.blade.php'));
     $css = file_get_contents(resource_path('css/app.css'));
 
+    // The desktop rail is fixed below the 3rem top bar and fills the rest of the viewport.
+    preg_match('/@media \(min-width: 1280px\) \{(?:(?!@media).)*?\n\s*\.application-settings-navigation \{([^}]*)\}/s', $css, $matches);
+    $railRule = $matches[1] ?? '';
+
     expect($sidebar)->toContain('application-settings-navigation')
-        ->and($css)->toContain('.application-settings-workspace > .application-settings-navigation')
-        ->and($css)->toContain('top: 4rem;')
-        ->and($css)->toContain('max-height: calc(100dvh - 5rem);');
+        ->and($railRule)->toContain('position: fixed;')
+        ->and($railRule)->toContain('top: 3rem;')
+        ->and($railRule)->toContain('height: calc(100dvh - 3rem);')
+        ->and($railRule)->toContain('overflow-y: auto;');
 });
 
 it('builds application sidebar routes independently of the current request route', function () {
diff --git a/tests/Feature/ServerNavbarStatusLayoutTest.php b/tests/Feature/ServerNavbarStatusLayoutTest.php
index 6da5f41582..c7b1315544 100644
--- a/tests/Feature/ServerNavbarStatusLayoutTest.php
+++ b/tests/Feature/ServerNavbarStatusLayoutTest.php
@@ -44,32 +44,38 @@ it('uses the branded input focus state for the server filter', function () {
         ->not->toContain('<x-reicon name="check"');
 });
 
-it('lists desktop proxy controls inline and keeps Traefik and refresh in Advanced', function () {
+it('lists desktop proxy controls in one split action and links Traefik beside it', function () {
     $navbar = file_get_contents(resource_path('views/livewire/server/navbar.blade.php'));
     $overflow = file_get_contents(resource_path('views/components/resource-heading-overflow.blade.php'));
-    $advanced = file_get_contents(resource_path('views/components/server/advanced.blade.php'));
     $desktopActions = str($navbar)->after("@teleport('#resource-action-hud-slot')")->before('@endteleport')->toString();
+    $splitAction = str($desktopActions)->after('id="server-desktop-actions"')->before('</x-split-action>')->toString();
+    $traefikLink = str($desktopActions)->before('<x-split-action id="server-desktop-actions"')->toString();
 
     expect($desktopActions)
         ->toContain('Restart Proxy')
         ->toContain('Stop Proxy')
         ->toContain('Start Proxy')
-        ->toContain('<x-server.advanced')
-        ->not->toContain('Traefik Dashboard')
-        ->not->toContain('Refresh Proxy Status')
+        ->toContain('<x-split-action id="server-desktop-actions"')
+        ->toContain('Traefik Dashboard')
+        ->not->toContain('<x-server.advanced')
         ->not->toContain('resource-heading-overflow-separator')
         ->not->toContain('<x-modal-confirmation');
 
-    expect(strpos($desktopActions, '<x-server.advanced'))
+    expect(strpos($desktopActions, 'Traefik Dashboard'))
         ->toBeLessThan(strpos($desktopActions, 'id="server-desktop-actions"'));
 
-    expect($advanced)
-        ->toContain('Advanced')
-        ->toContain('name="grid"')
-        ->toContain('Traefik Dashboard')
-        ->toContain('name="external-link" class="size-3! opacity-70"')
-        ->toContain('class="flex size-4 shrink-0 items-center justify-center"')
-        ->toContain('Refresh Proxy Status');
+    expect($traefikLink)
+        ->toContain('@if ($traefikDashboardAvailable)')
+        ->toContain('target="_blank"')
+        ->toContain('href="http://{{ $serverIp }}:8080"')
+        ->toContain('name="external-link" class="size-3.5 shrink-0 opacity-70"');
+
+    expect($splitAction)
+        ->toContain('<x-slot:main')
+        ->toContain('listbox-option')
+        ->toContain('wire:click="checkProxyStatus"')
+        ->toContain('Refresh Proxy Status')
+        ->not->toContain('Traefik');
 
     expect($overflow)
         ->toContain('Actions')
diff --git a/tests/Feature/ServerSidebarIconsTest.php b/tests/Feature/ServerSidebarIconsTest.php
index bdc9cdaddd..9592105ef2 100644
--- a/tests/Feature/ServerSidebarIconsTest.php
+++ b/tests/Feature/ServerSidebarIconsTest.php
@@ -62,6 +62,9 @@ it('shows a warning icon when a server menu item requires attention', function (
         ->toContain('proxyConfigurationPending: @js($server->hasPendingProxyConfiguration()),')
         ->toContain('traefikOutdated: @js($server->hasCurrentTraefikOutdatedInfo())')
         ->toContain('@proxy-configuration-state-changed.window')
+        ->toContain('proxyNotRunning: @js($proxyNotRunning)')
+        ->toContain('proxyNotRunning = $event.detail.proxyNotRunning')
+        ->toContain('x-show="proxyConfigurationPending || traefikOutdated || proxyNotRunning"')
         ->toContain('@sentinel-status-changed.window')
         ->toContain('sentinelOutOfSync = $event.detail.outOfSync')
         ->toContain('scheduleSentinelExpiry($event.detail.expiresInMilliseconds)')
diff --git a/tests/Feature/ServiceDatabaseVerticalNavigationTest.php b/tests/Feature/ServiceDatabaseVerticalNavigationTest.php
index 0afd70dffc..21c0801e56 100644
--- a/tests/Feature/ServiceDatabaseVerticalNavigationTest.php
+++ b/tests/Feature/ServiceDatabaseVerticalNavigationTest.php
@@ -59,7 +59,7 @@ it('groups database and service navigation by user workflow', function () {
     foreach ($serviceSidebars as $serviceSidebar) {
         expect($serviceSidebar)
             ->toContain("'Settings' => ['General', 'Domains', 'Environment Variables', 'Persistent Storage']")
-            ->toContain("'Observe & troubleshoot' => ['Runtime Logs', 'Terminal']")
+            ->toContain("'Observe & troubleshoot' => ['Runtime Logs', 'Terminal', 'Analytics']")
             ->toContain("'Automation' => ['Scheduled Tasks', 'Webhooks', 'Backups', 'Import Backup']")
             ->toContain("'Operations' => ['Resource Operations', 'Tags', 'Danger Zone']");
     }
@@ -347,6 +347,6 @@ it('shows the service sidebar on runtime logs and terminal pages', function () {
         ->toContain("in_array(\$type, ['application', 'database', 'service', 'server'], true)")
         ->toContain('<x-service.configuration-sidebar :service="$resource" current-route="project.service.command"')
         ->and($sidebar)
-        ->toContain("'Observe & troubleshoot' => ['Runtime Logs', 'Terminal']")
+        ->toContain("'Observe & troubleshoot' => ['Runtime Logs', 'Terminal', 'Analytics']")
         ->toContain("'Operations' => ['Resource Operations', 'Tags', 'Danger Zone']");
 });
diff --git a/tests/Feature/StaleStartActivityTest.php b/tests/Feature/StaleStartActivityTest.php
index 0867fa7187..6560fe0366 100644
--- a/tests/Feature/StaleStartActivityTest.php
+++ b/tests/Feature/StaleStartActivityTest.php
@@ -170,3 +170,32 @@ it('runs the interrupted start cleanup from app:init', function () {
 
     expect($source)->toContain('ResourceStartActivity::failInterrupted()');
 });
+
+it('marks interrupted database imports as failed on startup and leaves other operations alone', function () {
+    $queuedImport = startActivity($this->database->uuid, ProcessStatus::QUEUED, 'database_import');
+    $runningImport = startActivity((string) Str::uuid(), ProcessStatus::IN_PROGRESS, 'database_import');
+    $finishedImport = startActivity($this->database->uuid, ProcessStatus::FINISHED, 'database_import');
+    $otherOperation = startActivity($this->database->uuid, ProcessStatus::IN_PROGRESS, 'something-else');
+
+    expect(ResourceStartActivity::failInterrupted())->toBe(2);
+
+    foreach ([$queuedImport, $runningImport] as $activity) {
+        $activity->refresh();
+        expect(data_get($activity, 'properties.status'))->toBe(ProcessStatus::ERROR->value)
+            ->and(data_get($activity, 'properties.error'))->toBe('Interrupted by a Coolify restart.');
+    }
+
+    expect(data_get($finishedImport->refresh(), 'properties.status'))->toBe(ProcessStatus::FINISHED->value)
+        ->and(data_get($otherOperation->refresh(), 'properties.status'))->toBe(ProcessStatus::IN_PROGRESS->value);
+});
+
+it('keeps a long silent import as running with the import limit instead of the start limit', function () {
+    $activity = startActivity($this->database->uuid, ProcessStatus::IN_PROGRESS, 'database_import', 30);
+
+    expect(ResourceStartActivity::isStale($activity))->toBeFalse()
+        ->and(databaseHeadingFor($this->database)->checkDeployments())->toBeTrue();
+
+    $stale = startActivity($this->database->uuid, ProcessStatus::IN_PROGRESS, 'database_import', intdiv(ResourceStartActivity::importStaleAfterSeconds(), 60) + 1);
+
+    expect(ResourceStartActivity::isStale($stale))->toBeTrue();
+});
diff --git a/tests/Feature/StartDatabaseImportBackupPreparationTest.php b/tests/Feature/StartDatabaseImportBackupPreparationTest.php
index 3fa0c42f55..4d301d0a79 100644
--- a/tests/Feature/StartDatabaseImportBackupPreparationTest.php
+++ b/tests/Feature/StartDatabaseImportBackupPreparationTest.php
@@ -12,6 +12,7 @@ use App\Models\StandaloneDocker;
 use App\Models\StandalonePostgresql;
 use App\Models\Team;
 use App\Support\DatabaseImport\DatabaseImportSource;
+use App\Support\ResourceStartActivity;
 use Illuminate\Filesystem\FilesystemAdapter;
 use Illuminate\Filesystem\FilesystemManager;
 use Illuminate\Foundation\Testing\RefreshDatabase;
@@ -19,6 +20,7 @@ use Illuminate\Support\Facades\Process;
 use Illuminate\Support\Facades\Queue;
 use Illuminate\Support\Facades\Storage;
 use Illuminate\Support\Str;
+use Spatie\Activitylog\Models\Activity;
 
 uses(RefreshDatabase::class);
 
@@ -157,3 +159,15 @@ test('s3 backups are prepared in the s3 helper and streamed into the database co
     Queue::assertPushed(CoolifyTask::class, fn (CoolifyTask $job) => ! array_key_exists('serverTmpPath', $job->call_event_data)
         && str_starts_with((string) $job->call_event_data['containerName'], 's3-restore-'));
 });
+
+test('the import activity is created with its operation, before the CoolifyTask job can load it', function () {
+    $operationsAtCreation = [];
+    Activity::created(function (Activity $activity) use (&$operationsAtCreation) {
+        $operationsAtCreation[] = $activity->getExtraProperty('operation');
+    });
+
+    importServerBackup($this, '/srv/backups/app.sql', '2d2d20506f73');
+
+    expect($operationsAtCreation)->toBe([ResourceStartActivity::DATABASE_IMPORT_OPERATION]);
+    Queue::assertPushed(CoolifyTask::class);
+});
diff --git a/tests/Feature/StartDatabaseImportConcurrencyTest.php b/tests/Feature/StartDatabaseImportConcurrencyTest.php
index d7d27a6c8c..bab4f99b83 100644
--- a/tests/Feature/StartDatabaseImportConcurrencyTest.php
+++ b/tests/Feature/StartDatabaseImportConcurrencyTest.php
@@ -11,6 +11,7 @@ use App\Models\StandalonePostgresql;
 use App\Models\Team;
 use App\Support\DatabaseImport\DatabaseImportException;
 use App\Support\DatabaseImport\DatabaseImportSource;
+use App\Support\ResourceStartActivity;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Support\Facades\Cache;
 use Illuminate\Support\Str;
@@ -123,3 +124,70 @@ test('a failed start releases the import lock', function () {
         $lock->release();
     }
 });
+
+function importActivity(string $databaseUuid, int $teamId, ProcessStatus $status, int $minutesSinceLastUpdate = 0): Activity
+{
+    $activity = Activity::create([
+        'log_name' => 'default',
+        'description' => '[]',
+        'properties' => [
+            'team_id' => $teamId,
+            'type_uuid' => $databaseUuid,
+            'operation' => 'database_import',
+            'status' => $status->value,
+        ],
+    ]);
+
+    Activity::query()->whereKey($activity->id)->update([
+        'created_at' => now()->subMinutes($minutesSinceLastUpdate),
+        'updated_at' => now()->subMinutes($minutesSinceLastUpdate),
+    ]);
+
+    return $activity->refresh();
+}
+
+test('an in-progress import that is silent for a long time but within the limit still blocks', function () {
+    $minutes = intdiv(ResourceStartActivity::importStaleAfterSeconds(), 60) - 5;
+    $activity = importActivity($this->database->uuid, $this->team->id, ProcessStatus::IN_PROGRESS, $minutes);
+
+    expect(fn () => startImport($this->database, $this->team->id))
+        ->toThrow(DatabaseImportException::class, 'A database import is already running.');
+
+    expect(data_get($activity->refresh(), 'properties.status'))->toBe(ProcessStatus::IN_PROGRESS->value);
+});
+
+test('a stale import does not block a new import and is marked as failed', function (ProcessStatus $status) {
+    $minutes = intdiv(ResourceStartActivity::importStaleAfterSeconds(), 60) + 5;
+    $stale = importActivity($this->database->uuid, $this->team->id, $status, $minutes);
+
+    // The guard lets the import through, so it fails later on the invalid path instead of with 409.
+    expect(fn () => startImport($this->database, $this->team->id))
+        ->toThrow(DatabaseImportException::class, 'The server path is invalid.');
+
+    $stale->refresh();
+    expect(data_get($stale, 'properties.status'))->toBe(ProcessStatus::ERROR->value)
+        ->and(data_get($stale, 'properties.error'))->toBe(ResourceStartActivity::STALE_MESSAGE)
+        ->and(data_get($stale, 'properties.exitCode'))->toBe(1);
+})->with([
+    'queued' => ProcessStatus::QUEUED,
+    'in progress' => ProcessStatus::IN_PROGRESS,
+]);
+
+test('the stale import limit follows a raised SSH command timeout', function () {
+    config()->set('constants.ssh.command_timeout', 5 * 3600);
+
+    expect(ResourceStartActivity::importStaleAfterSeconds())->toBeGreaterThan(5 * 3600);
+});
+
+test('an import interrupted by a Coolify restart is failed at boot and no longer blocks a new import', function () {
+    $interrupted = importActivity($this->database->uuid, $this->team->id, ProcessStatus::IN_PROGRESS);
+
+    expect(ResourceStartActivity::failInterrupted())->toBe(1);
+
+    $interrupted->refresh();
+    expect(data_get($interrupted, 'properties.status'))->toBe(ProcessStatus::ERROR->value)
+        ->and(data_get($interrupted, 'properties.error'))->toBe(ResourceStartActivity::INTERRUPTED_MESSAGE);
+
+    expect(fn () => startImport($this->database, $this->team->id))
+        ->toThrow(DatabaseImportException::class, 'The server path is invalid.');
+});
diff --git a/tests/Feature/TerminalSessionStartFailureTest.php b/tests/Feature/TerminalSessionStartFailureTest.php
new file mode 100644
index 0000000000..0da9a68efb
--- /dev/null
+++ b/tests/Feature/TerminalSessionStartFailureTest.php
@@ -0,0 +1,272 @@
+<?php
+
+use App\Livewire\Project\Shared\ExecuteContainerCommand;
+use App\Livewire\Project\Shared\Terminal;
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\PrivateKey;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Routing\Events\RouteMatched;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\Event;
+use Illuminate\Support\Facades\Process;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::forceCreate(['id' => 0]);
+    config([
+        'app.maintenance.store' => 'array',
+        'constants.ssh.mux_enabled' => false,
+    ]);
+    Cache::flush();
+
+    $this->team = Team::factory()->create();
+    $this->owner = User::factory()->create();
+    $this->owner->teams()->attach($this->team, ['role' => 'owner']);
+    $this->privateKey = PrivateKey::factory()->create(['team_id' => $this->team->id]);
+    $this->server = Server::factory()->create([
+        'team_id' => $this->team->id,
+        'private_key_id' => $this->privateKey->id,
+    ]);
+    $this->server->settings->update([
+        'is_reachable' => true,
+        'is_usable' => true,
+        'is_terminal_enabled' => true,
+    ]);
+
+    $this->actingAs($this->owner);
+    session(['currentTeam' => $this->team]);
+});
+
+/**
+ * Fake the SSH commands used before a container terminal token is issued.
+ */
+function fakeTerminalContainer(string $state, bool $hasShell = true, array $runningContainers = []): void
+{
+    Process::fake(function ($process) use ($state, $hasShell, $runningContainers) {
+        $command = (string) $process->command;
+
+        if (str_contains($command, 'docker ps -a')) {
+            return Process::result(output: collect($runningContainers)
+                ->map(fn (string $name) => json_encode(['Names' => $name, 'State' => 'running', 'Labels' => '']))
+                ->implode("\n"));
+        }
+
+        if (str_contains($command, 'docker inspect')) {
+            return Process::result(output: json_encode(['State' => ['Status' => $state]]));
+        }
+
+        if (str_contains($command, "-c 'exit 0'")) {
+            return $hasShell ? Process::result() : Process::result(exitCode: 1);
+        }
+
+        return Process::result();
+    });
+}
+
+function actAsTerminalMember(Team $team): void
+{
+    $member = User::factory()->create();
+    $member->teams()->attach($team, ['role' => 'member']);
+    test()->actingAs($member);
+    session(['currentTeam' => $team]);
+}
+
+/**
+ * Make `get_route_parameters()` return the page parameters. Livewire::test() mounts the
+ * component through its own testing route, so add the parameters to every matched route.
+ */
+function bindTerminalRouteParameters(array $parameters): void
+{
+    Event::listen(RouteMatched::class, function (RouteMatched $event) use ($parameters): void {
+        foreach ($parameters as $name => $value) {
+            $event->route->setParameter($name, $value);
+        }
+    });
+}
+
+function createTerminalApplication(Server $server, Team $team): Application
+{
+    $destination = StandaloneDocker::query()->where('server_id', $server->id)->firstOrFail();
+    $project = Project::factory()->create(['team_id' => $team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+
+    return Application::factory()->create([
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+    ]);
+}
+
+describe('Terminal::sendTerminalCommand', function () {
+    it('issues a token for a running container with a shell', function () {
+        fakeTerminalContainer('running');
+
+        Livewire::test(Terminal::class)
+            ->call('sendTerminalCommand', true, 'app-container', $this->server->uuid)
+            ->assertDispatched('send-terminal-token')
+            ->assertNotDispatched(Terminal::SESSION_FAILED_EVENT);
+    });
+
+    it('reports a stopped container instead of leaving the terminal connecting', function () {
+        fakeTerminalContainer('exited');
+
+        Livewire::test(Terminal::class)
+            ->call('sendTerminalCommand', true, 'app-container', $this->server->uuid)
+            ->assertDispatched(Terminal::SESSION_FAILED_EVENT, message: 'The container is not running.')
+            ->assertNotDispatched('send-terminal-token');
+    });
+
+    it('reports a container without a shell', function () {
+        fakeTerminalContainer('running', hasShell: false);
+
+        Livewire::test(Terminal::class)
+            ->call('sendTerminalCommand', true, 'app-container', $this->server->uuid)
+            ->assertDispatched(Terminal::SESSION_FAILED_EVENT, message: 'No shell is available in this container.')
+            ->assertSet('hasShell', false)
+            ->assertNotDispatched('send-terminal-token');
+    });
+
+    it('reports an invalid container name without running remote commands', function () {
+        Process::fake();
+
+        Livewire::test(Terminal::class)
+            ->call('sendTerminalCommand', true, '-oProxyCommand=id', $this->server->uuid)
+            ->assertDispatched(Terminal::SESSION_FAILED_EVENT, message: 'The container name is not valid.')
+            ->assertNotDispatched('send-terminal-token');
+
+        Process::assertNothingRan();
+    });
+
+    it('reports a server with terminal access disabled', function () {
+        Process::fake();
+        $this->server->settings->update(['is_terminal_enabled' => false]);
+
+        Livewire::test(Terminal::class)
+            ->call('sendTerminalCommand', false, $this->server->name, $this->server->uuid)
+            ->assertDispatched(Terminal::SESSION_FAILED_EVENT, message: 'Terminal access is disabled on this server.')
+            ->assertNotDispatched('send-terminal-token');
+
+        Process::assertNothingRan();
+    });
+
+    it('denies members with a generic message and no token', function () {
+        Process::fake();
+        actAsTerminalMember($this->team);
+
+        Livewire::test(Terminal::class)
+            ->call('sendTerminalCommand', true, 'app-container', $this->server->uuid)
+            ->assertDispatched(Terminal::SESSION_FAILED_EVENT, message: Terminal::NOT_ALLOWED_MESSAGE)
+            ->assertNotDispatched('send-terminal-token');
+
+        Process::assertNothingRan();
+    });
+
+    it('denies a server of another team with the same generic message', function () {
+        Process::fake();
+        $otherTeam = Team::factory()->create();
+        $otherServer = Server::factory()->create([
+            'team_id' => $otherTeam->id,
+            'private_key_id' => $this->privateKey->id,
+        ]);
+
+        Livewire::test(Terminal::class)
+            ->call('sendTerminalCommand', false, $otherServer->name, $otherServer->uuid)
+            ->assertDispatched(Terminal::SESSION_FAILED_EVENT, message: Terminal::NOT_ALLOWED_MESSAGE)
+            ->assertNotDispatched('send-terminal-token');
+
+        Process::assertNothingRan();
+    });
+});
+
+describe('ExecuteContainerCommand', function () {
+    it('reports a denied server terminal to the terminal component', function () {
+        Process::fake();
+        bindTerminalRouteParameters(['server_uuid' => $this->server->uuid]);
+        $component = Livewire::test(ExecuteContainerCommand::class);
+
+        actAsTerminalMember($this->team);
+
+        $component->call('connectToServer')
+            ->assertDispatchedTo(Terminal::class, Terminal::SESSION_FAILED_EVENT, message: Terminal::NOT_ALLOWED_MESSAGE)
+            ->assertNotDispatched('send-terminal-command');
+    });
+
+    it('reports a disabled server to the terminal component', function () {
+        Process::fake();
+        bindTerminalRouteParameters(['server_uuid' => $this->server->uuid]);
+        $component = Livewire::test(ExecuteContainerCommand::class);
+
+        $this->server->settings->update(['force_disabled' => true]);
+
+        $component->call('connectToServer')
+            ->assertDispatchedTo(Terminal::class, Terminal::SESSION_FAILED_EVENT, message: 'Server is disabled.')
+            ->assertNotDispatched('send-terminal-command');
+    });
+
+    it('reports a missing container selection to the terminal component', function () {
+        fakeTerminalContainer('running');
+        $application = createTerminalApplication($this->server, $this->team);
+        bindTerminalRouteParameters(['application_uuid' => $application->uuid]);
+
+        Livewire::test(ExecuteContainerCommand::class)
+            ->call('connectToContainer')
+            ->assertDispatchedTo(Terminal::class, Terminal::SESSION_FAILED_EVENT, message: 'Please select a container.')
+            ->assertNotDispatched('send-terminal-command');
+    });
+
+    it('reports a container that is no longer in the running list', function () {
+        fakeTerminalContainer('running');
+        $application = createTerminalApplication($this->server, $this->team);
+        bindTerminalRouteParameters(['application_uuid' => $application->uuid]);
+
+        Livewire::test(ExecuteContainerCommand::class)
+            ->set('selected_container', "{$this->server->uuid}:gone-container")
+            ->assertDispatchedTo(Terminal::class, Terminal::SESSION_FAILED_EVENT, message: 'Container not found.')
+            ->assertNotDispatched('send-terminal-command');
+    });
+
+    it('denies members before it looks up the container', function () {
+        fakeTerminalContainer('running');
+        $application = createTerminalApplication($this->server, $this->team);
+        bindTerminalRouteParameters(['application_uuid' => $application->uuid]);
+        $component = Livewire::test(ExecuteContainerCommand::class);
+
+        actAsTerminalMember($this->team);
+
+        $component->set('selected_container', "{$this->server->uuid}:app-container")
+            ->assertDispatchedTo(Terminal::class, Terminal::SESSION_FAILED_EVENT, message: Terminal::NOT_ALLOWED_MESSAGE)
+            ->assertNotDispatched('send-terminal-command');
+    });
+
+    it('auto-connects when exactly one container is running', function () {
+        fakeTerminalContainer('running', runningContainers: ['app-container']);
+        $application = createTerminalApplication($this->server, $this->team);
+        bindTerminalRouteParameters(['application_uuid' => $application->uuid]);
+
+        Livewire::test(ExecuteContainerCommand::class)
+            ->call('loadContainers')
+            ->assertDispatched('send-terminal-command')
+            ->assertNotDispatched(Terminal::AUTO_START_CANCELLED_EVENT)
+            ->assertNotDispatched(Terminal::SESSION_FAILED_EVENT);
+    });
+
+    it('cancels the terminal auto-start when the user must choose a container', function () {
+        fakeTerminalContainer('running', runningContainers: ['app-container-a', 'app-container-b']);
+        $application = createTerminalApplication($this->server, $this->team);
+        bindTerminalRouteParameters(['application_uuid' => $application->uuid]);
+
+        Livewire::test(ExecuteContainerCommand::class)
+            ->call('loadContainers')
+            ->assertDispatchedTo(Terminal::class, Terminal::AUTO_START_CANCELLED_EVENT)
+            ->assertNotDispatched('send-terminal-command');
+    });
+});
diff --git a/tests/Feature/TrafficAnalytics/CaddyComposeTrafficLabelsTest.php b/tests/Feature/TrafficAnalytics/CaddyComposeTrafficLabelsTest.php
new file mode 100644
index 0000000000..4ed808a97a
--- /dev/null
+++ b/tests/Feature/TrafficAnalytics/CaddyComposeTrafficLabelsTest.php
@@ -0,0 +1,209 @@
+<?php
+
+use App\Enums\ProxyTypes;
+use App\Models\Application;
+use App\Models\ApplicationPreview;
+use App\Models\Environment;
+use App\Models\PrivateKey;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\Service;
+use App\Models\ServiceApplication;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Collection;
+use Illuminate\Support\Facades\Bus;
+use Illuminate\Support\Facades\Process;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    Bus::fake();
+    Process::fake();
+    config(['constants.ssh.mux_enabled' => false]);
+    Server::flushIdentityMap();
+
+    $this->team = Team::factory()->create();
+    $this->environment = Environment::factory()->create([
+        'project_id' => Project::factory()->create(['team_id' => $this->team->id])->id,
+    ]);
+});
+
+afterEach(fn () => Server::flushIdentityMap());
+
+/**
+ * A server that runs a Caddy image with `log_append` support (caddy-docker-proxy 2.9+).
+ */
+function caddyComposeTrafficServer(object $test, bool $analyticsEnabled, bool $exactLabels = false): Server
+{
+    $server = Server::factory()->create([
+        'team_id' => $test->team->id,
+        'private_key_id' => PrivateKey::factory()->create(['team_id' => $test->team->id])->id,
+        'proxy' => [
+            'type' => ProxyTypes::CADDY->value,
+            'status' => 'running',
+            'last_saved_settings' => 'applied',
+            'last_applied_settings' => 'applied',
+            'last_saved_proxy_configuration' => "services:\n  caddy:\n    image: 'lucaslorentz/caddy-docker-proxy:2.11-alpine'\n",
+        ],
+    ]);
+    $server->settings->update([
+        'is_traffic_analytics_enabled' => $analyticsEnabled,
+        'generate_exact_labels' => $exactLabels,
+    ]);
+    Server::flushIdentityMap();
+
+    return $server->fresh();
+}
+
+function caddyComposeTrafficApplication(object $test, Server $server): Application
+{
+    $destination = StandaloneDocker::query()->where('server_id', $server->id)->firstOrFail();
+
+    return Application::factory()->create([
+        'environment_id' => $test->environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+        'build_pack' => 'dockercompose',
+        'docker_compose_raw' => "services:\n  web.app:\n    image: nginx:alpine\n",
+        'docker_compose_domains' => json_encode([
+            'web.app' => ['domain' => 'https://app.example.com'],
+        ]),
+    ]);
+}
+
+function caddyComposeTrafficService(object $test, Server $server): Service
+{
+    $destination = StandaloneDocker::query()->where('server_id', $server->id)->firstOrFail();
+    $service = Service::factory()->create([
+        'environment_id' => $test->environment->id,
+        'server_id' => $server->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+        'docker_compose_raw' => "services:\n  web_app:\n    image: nginx:alpine\n",
+    ]);
+    ServiceApplication::create([
+        'name' => 'web_app',
+        'service_id' => $service->id,
+        'fqdn' => 'https://service.example.com',
+    ]);
+
+    return $service->fresh();
+}
+
+function composeServiceLabels(Collection $compose, string $serviceName): Collection
+{
+    // Service names can contain dots, so data_get() cannot be used for the service key.
+    return collect(data_get($compose, 'services')[$serviceName]['labels'] ?? [])->values();
+}
+
+it('logs compose application traffic on Caddy with the same key as the Traefik router', function (bool $exactLabels) {
+    $server = caddyComposeTrafficServer($this, analyticsEnabled: true, exactLabels: $exactLabels);
+    $application = caddyComposeTrafficApplication($this, $server);
+
+    $labels = composeServiceLabels(applicationParser($application), 'web.app');
+    $key = $application->uuid.'-'.traefikSafeServiceNameSegment('web.app');
+
+    expect($labels->all())
+        ->toContain('caddy_0.log.output=file /traffic/access.log')
+        ->toContain("caddy_0.log_append=coolify_app_id {$key}");
+    if (! $exactLabels) {
+        expect($labels->all())->toContain("traefik.http.routers.https-0-{$key}.entryPoints=https");
+    }
+})->with([
+    'exact Caddy labels' => true,
+    'Traefik and Caddy labels' => false,
+]);
+
+it('uses the preview uuid in the Caddy traffic key of a compose preview', function () {
+    $server = caddyComposeTrafficServer($this, analyticsEnabled: true);
+    $application = caddyComposeTrafficApplication($this, $server);
+    $preview = ApplicationPreview::create([
+        'application_id' => $application->id,
+        'pull_request_id' => 42,
+        'pull_request_html_url' => 'https://github.com/example/repo/pull/42',
+        'docker_compose_domains' => $application->docker_compose_domains,
+    ]);
+
+    $labels = composeServiceLabels(applicationParser($application, 42, $preview->id), 'web.app-pr-42');
+    $key = "{$application->uuid}-42-".traefikSafeServiceNameSegment('web.app');
+
+    expect($labels->all())
+        ->toContain("caddy_0.log_append=coolify_app_id {$key}")
+        ->toContain("traefik.http.routers.https-0-{$key}.entryPoints=https");
+});
+
+it('logs service traffic on Caddy with the same key as the Traefik router', function (bool $exactLabels) {
+    $server = caddyComposeTrafficServer($this, analyticsEnabled: true, exactLabels: $exactLabels);
+    $service = caddyComposeTrafficService($this, $server);
+
+    $labels = composeServiceLabels(serviceParser($service), 'web_app');
+    $key = $service->uuid.'-'.traefikSafeServiceNameSegment('web_app');
+
+    expect($labels->all())
+        ->toContain('caddy_0.log.output=file /traffic/access.log')
+        ->toContain("caddy_0.log_append=coolify_app_id {$key}");
+    if (! $exactLabels) {
+        expect($labels->all())->toContain("traefik.http.routers.https-0-{$key}.entryPoints=https");
+    }
+})->with([
+    'exact Caddy labels' => true,
+    'Traefik and Caddy labels' => false,
+]);
+
+it('logs legacy parser service traffic on Caddy with the same key as the Traefik router', function () {
+    $server = caddyComposeTrafficServer($this, analyticsEnabled: true);
+    $service = caddyComposeTrafficService($this, $server);
+    $service->update(['compose_parsing_version' => '2']);
+
+    $compose = parseDockerComposeFile($service->fresh());
+    $labels = composeServiceLabels($compose, 'web_app');
+    $key = $service->uuid.'-'.traefikSafeServiceNameSegment('web_app');
+
+    expect($labels->all())
+        ->toContain('caddy_0.log.output=file /traffic/access.log')
+        ->toContain("caddy_0.log_append=coolify_app_id {$key}")
+        ->toContain("traefik.http.routers.https-0-{$key}.entryPoints=https");
+});
+
+it('logs legacy parser compose application traffic on Caddy with the service key', function () {
+    $server = caddyComposeTrafficServer($this, analyticsEnabled: true);
+    $application = caddyComposeTrafficApplication($this, $server);
+    $application->update(['compose_parsing_version' => '2']);
+
+    $compose = parseDockerComposeFile($application->fresh());
+    $labels = composeServiceLabels($compose, 'web.app');
+    $key = $application->uuid.'-'.traefikSafeServiceNameSegment('web.app');
+
+    expect($labels->all())
+        ->toContain('caddy_0.log.output=file /traffic/access.log')
+        ->toContain("caddy_0.log_append=coolify_app_id {$key}");
+});
+
+it('adds no Caddy traffic labels to compose resources when analytics is off', function () {
+    $server = caddyComposeTrafficServer($this, analyticsEnabled: false);
+    $application = caddyComposeTrafficApplication($this, $server);
+    $service = caddyComposeTrafficService($this, $server);
+
+    $labels = composeServiceLabels(applicationParser($application), 'web.app')
+        ->merge(composeServiceLabels(serviceParser($service), 'web_app'));
+
+    expect($labels->filter(fn (string $label) => str_contains($label, '.log')))->toBeEmpty();
+});
+
+it('keeps the application uuid as the Caddy traffic key of a normal application', function () {
+    $server = caddyComposeTrafficServer($this, analyticsEnabled: true);
+    $destination = StandaloneDocker::query()->where('server_id', $server->id)->firstOrFail();
+    $application = Application::factory()->create([
+        'environment_id' => $this->environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+        'fqdn' => 'https://normal.example.com',
+    ]);
+
+    $labels = collect(generateLabelsApplication($application->fresh()));
+
+    expect($labels->filter(fn (string $label) => str_contains($label, 'log_append'))->values()->all())
+        ->toBe(["caddy_0.log_append=coolify_app_id {$application->uuid}"]);
+});
diff --git a/tests/Feature/TrafficAnalytics/CaddyTrafficLabelsTest.php b/tests/Feature/TrafficAnalytics/CaddyTrafficLabelsTest.php
index 30c350e46f..0f18877183 100644
--- a/tests/Feature/TrafficAnalytics/CaddyTrafficLabelsTest.php
+++ b/tests/Feature/TrafficAnalytics/CaddyTrafficLabelsTest.php
@@ -31,3 +31,19 @@ it('omits lumberjack roll directives when disabled', function () {
     $labels = fqdnLabelsForCaddy('coolify', 'app-uuid', collect(['https://example.com']), is_traffic_analytics_enabled: false);
     expect($labels->filter(fn ($l) => str_contains($l, 'roll_'))->isEmpty())->toBeTrue();
 });
+
+it('keys a compose service like its Traefik router', function () {
+    $labels = fqdnLabelsForCaddy('coolify', 'app-uuid', collect(['https://example.com']), service_name: 'web.app', is_traffic_analytics_enabled: true, supports_log_append: true);
+    $key = 'app-uuid-'.traefikSafeServiceNameSegment('web.app');
+
+    expect($key)->toMatch('/^[A-Za-z0-9-]+$/')
+        ->and($labels->contains("caddy_0.log_append=coolify_app_id {$key}"))->toBeTrue()
+        ->and($labels->contains('caddy_0.log.output=file /traffic/access.log'))->toBeTrue();
+});
+
+it('keeps only safe characters in the caddy traffic key', function () {
+    $labels = fqdnLabelsForCaddy('coolify', "app uuid\n{x}", collect(['https://example.com']), is_traffic_analytics_enabled: true, supports_log_append: true);
+
+    expect($labels->first(fn ($label) => str_contains($label, 'log_append')))
+        ->toBe('caddy_0.log_append=coolify_app_id app-uuid-x-');
+});
diff --git a/tests/Feature/TrafficAnalytics/ChangeProxySentinelRestartTest.php b/tests/Feature/TrafficAnalytics/ChangeProxySentinelRestartTest.php
new file mode 100644
index 0000000000..592e92da51
--- /dev/null
+++ b/tests/Feature/TrafficAnalytics/ChangeProxySentinelRestartTest.php
@@ -0,0 +1,95 @@
+<?php
+
+use App\Actions\Proxy\StartProxy;
+use App\Actions\Server\StartSentinel;
+use App\Enums\ProxyTypes;
+use App\Models\Server;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Queue;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    Queue::fake();
+    Server::flushIdentityMap();
+    $this->team = User::factory()->create()->teams()->first();
+});
+
+afterEach(fn () => Server::flushIdentityMap());
+
+function proxySwitchServer(object $test, string $proxyType, bool $sentinelEnabled, bool $analyticsEnabled): Server
+{
+    $server = Server::factory()->create(['team_id' => $test->team->id]);
+    $server->proxy->set('type', $proxyType);
+    $server->save();
+    $server->settings->is_sentinel_enabled = $sentinelEnabled;
+    $server->settings->is_traffic_analytics_enabled = $analyticsEnabled;
+    $server->settings->save();
+    Server::flushIdentityMap();
+
+    return $server->fresh();
+}
+
+it('restarts Sentinel after a proxy switch when Sentinel and traffic analytics are on', function (string $from, string $to) {
+    $server = proxySwitchServer($this, $from, sentinelEnabled: true, analyticsEnabled: true);
+
+    $server->changeProxy($to, async: true);
+
+    StartSentinel::assertPushed(1);
+})->with([
+    'Traefik to Caddy' => [ProxyTypes::TRAEFIK->value, ProxyTypes::CADDY->value],
+    'Caddy to Traefik' => [ProxyTypes::CADDY->value, ProxyTypes::TRAEFIK->value],
+    'Traefik to none' => [ProxyTypes::TRAEFIK->value, ProxyTypes::NONE->value],
+    'Caddy to Nginx' => [ProxyTypes::CADDY->value, ProxyTypes::NGINX->value],
+]);
+
+it('restarts Sentinel when the Livewire switch selects the proxy synchronously', function () {
+    StartProxy::shouldRun();
+    $server = proxySwitchServer($this, ProxyTypes::TRAEFIK->value, sentinelEnabled: true, analyticsEnabled: true);
+
+    $server->changeProxy(ProxyTypes::CADDY->value, async: false);
+
+    StartSentinel::assertPushed(1);
+});
+
+it('does not restart Sentinel after a proxy switch when nothing relevant is on', function (bool $sentinelEnabled, bool $analyticsEnabled) {
+    $server = proxySwitchServer($this, ProxyTypes::TRAEFIK->value, $sentinelEnabled, $analyticsEnabled);
+
+    $server->changeProxy(ProxyTypes::CADDY->value, async: true);
+
+    StartSentinel::assertNotPushed();
+    expect((bool) $server->fresh()->settings->is_sentinel_enabled)->toBe($sentinelEnabled);
+})->with([
+    'analytics off' => [true, false],
+    'Sentinel off' => [false, true],
+    'both off' => [false, false],
+]);
+
+it('does not restart Sentinel when the proxy type does not change', function () {
+    $server = proxySwitchServer($this, ProxyTypes::CADDY->value, sentinelEnabled: true, analyticsEnabled: true);
+
+    $server->changeProxy(ProxyTypes::CADDY->value, async: true);
+
+    StartSentinel::assertNotPushed();
+});
+
+it('points Sentinel at the Caddy access log after a switch from Traefik', function () {
+    $server = proxySwitchServer($this, ProxyTypes::TRAEFIK->value, sentinelEnabled: true, analyticsEnabled: true);
+    expect(StartSentinel::trafficLogDirectory($server))->toBe('/data/coolify/proxy');
+
+    $server->changeProxy(ProxyTypes::CADDY->value, async: true);
+    $server = $server->fresh();
+
+    expect(StartSentinel::trafficLogDirectory($server))->toBe('/data/coolify/proxy/caddy')
+        ->and(StartSentinel::sentinelTrafficEnvironment($server)['TRAFFIC_ACCESS_LOG_PATH'])
+        ->toBe('/data/coolify/proxy/caddy/access.log');
+});
+
+it('gives Sentinel no traffic environment after a switch to a proxy without analytics support', function () {
+    $server = proxySwitchServer($this, ProxyTypes::TRAEFIK->value, sentinelEnabled: true, analyticsEnabled: true);
+
+    $server->changeProxy(ProxyTypes::NONE->value, async: true);
+
+    expect(StartSentinel::sentinelTrafficEnvironment($server->fresh()))->toBe([]);
+});
diff --git a/tests/Feature/TrafficAnalytics/ChartTokensTest.php b/tests/Feature/TrafficAnalytics/ChartTokensTest.php
index 8406b34e24..fa6ad02aa2 100644
--- a/tests/Feature/TrafficAnalytics/ChartTokensTest.php
+++ b/tests/Feature/TrafficAnalytics/ChartTokensTest.php
@@ -168,7 +168,8 @@ it('shows values with local and UTC timestamps in analytics chart tooltips', fun
 
     foreach ([
         app_path('Livewire/Analytics.php'),
-        app_path('Livewire/Project/Application/Analytics.php'),
+        // Shared by the application and service analytics tabs.
+        app_path('Livewire/Project/Shared/ResourceTrafficAnalytics.php'),
         app_path('Livewire/Dashboard/TrafficAnalytics.php'),
     ] as $component) {
         expect(file_get_contents($component))->toContain("'sparkCategories' => array_column(\$this->series, 'bucket')");
diff --git a/tests/Feature/TrafficAnalytics/ConfigureTrafficAnalyticsTest.php b/tests/Feature/TrafficAnalytics/ConfigureTrafficAnalyticsTest.php
index 54ac92fdaf..765f4aa5dc 100644
--- a/tests/Feature/TrafficAnalytics/ConfigureTrafficAnalyticsTest.php
+++ b/tests/Feature/TrafficAnalytics/ConfigureTrafficAnalyticsTest.php
@@ -58,3 +58,129 @@ it('disables analytics', function () {
 
     expect($server->fresh()->isTrafficAnalyticsEnabled())->toBeFalse();
 });
+
+function trafficAnalyticsProxyServer(object $test, string $proxyType, array $proxy = [], bool $analyticsEnabled = false): Server
+{
+    $server = Server::factory()->create(['team_id' => $test->team->id]);
+    $server->proxy->set('type', $proxyType);
+    foreach ($proxy as $key => $value) {
+        $server->proxy->set($key, $value);
+    }
+    $server->save();
+    $server->settings->is_traffic_analytics_enabled = $analyticsEnabled;
+    $server->settings->save();
+
+    return $server->fresh();
+}
+
+it('rejects enabling analytics when the server has no traefik or caddy proxy', function (string $proxyType) {
+    Queue::fake();
+    StartSentinel::partialMock()->shouldReceive('handle')->never();
+    SaveProxyConfiguration::partialMock()->shouldReceive('handle')->never();
+
+    $server = trafficAnalyticsProxyServer($this, $proxyType);
+
+    expect(fn () => ConfigureTrafficAnalytics::run($server, true))
+        ->toThrow(RuntimeException::class, 'Traffic analytics needs the Traefik or Caddy proxy.');
+
+    expect($server->fresh()->isTrafficAnalyticsEnabled())->toBeFalse()
+        ->and($server->isTrafficAnalyticsEnabled())->toBeFalse()
+        ->and($server->fresh()->proxy->get('last_saved_proxy_configuration'))->toBeNull();
+    Queue::assertNotPushed(RestartProxyJob::class);
+})->with(['NONE', 'NGINX']);
+
+it('lets a server without a usable proxy turn analytics off', function () {
+    Queue::fake();
+    StartSentinel::partialMock()->shouldReceive('handle')->once();
+    SaveProxyConfiguration::partialMock()->shouldReceive('handle')->never();
+
+    $server = trafficAnalyticsProxyServer($this, 'NONE', analyticsEnabled: true);
+    $server->settings->is_sentinel_enabled = true;
+    $server->settings->save();
+
+    expect(ConfigureTrafficAnalytics::run($server, false))->toBeFalse();
+
+    expect($server->fresh()->isTrafficAnalyticsEnabled())->toBeFalse();
+    Queue::assertNotPushed(RestartProxyJob::class);
+});
+
+it('keeps the analytics setting and saved proxy configuration unchanged when saving the configuration fails', function (bool $enable) {
+    Queue::fake();
+    StartSentinel::partialMock()->shouldReceive('handle')->never();
+    GetProxyConfiguration::partialMock()->shouldReceive('handle')->once()->andReturn("services:\n  traefik:\n    command: []\n");
+    SaveProxyConfiguration::partialMock()->shouldReceive('handle')->once()->andReturnUsing(function (Server $server, string $configuration) {
+        $server->proxy->last_saved_settings = 'new-hash';
+        $server->proxy->last_saved_proxy_configuration = $configuration;
+        $server->save();
+
+        throw new RuntimeException('SSH connection failed.');
+    });
+
+    $server = trafficAnalyticsProxyServer($this, 'TRAEFIK', [
+        'status' => 'running',
+        'last_saved_settings' => 'old-hash',
+        'last_saved_proxy_configuration' => 'old-configuration',
+    ], analyticsEnabled: ! $enable);
+
+    expect(fn () => ConfigureTrafficAnalytics::run($server, $enable))
+        ->toThrow(RuntimeException::class, 'SSH connection failed.');
+
+    $fresh = $server->fresh();
+    expect($fresh->isTrafficAnalyticsEnabled())->toBe(! $enable)
+        ->and($server->isTrafficAnalyticsEnabled())->toBe(! $enable)
+        ->and($fresh->proxy->get('last_saved_settings'))->toBe('old-hash')
+        ->and($fresh->proxy->get('last_saved_proxy_configuration'))->toBe('old-configuration');
+    Queue::assertNotPushed(RestartProxyJob::class);
+})->with(['enabling' => true, 'disabling' => false]);
+
+it('keeps the analytics setting unchanged when the proxy configuration is not a mapping', function () {
+    Queue::fake();
+    StartSentinel::partialMock()->shouldReceive('handle')->never();
+    GetProxyConfiguration::partialMock()->shouldReceive('handle')->once()->andReturn("services:\n  traefik:\n    command: '--api'\n");
+    SaveProxyConfiguration::partialMock()->shouldReceive('handle')->never();
+
+    $server = trafficAnalyticsProxyServer($this, 'TRAEFIK', ['status' => 'running']);
+
+    expect(fn () => ConfigureTrafficAnalytics::run($server, true))->toThrow(Exception::class);
+
+    expect($server->fresh()->isTrafficAnalyticsEnabled())->toBeFalse()
+        ->and($server->isTrafficAnalyticsEnabled())->toBeFalse();
+    Queue::assertNotPushed(RestartProxyJob::class);
+});
+
+it('saves the configuration without starting a proxy the user stopped', function (array $proxy) {
+    Queue::fake();
+    StartSentinel::partialMock()->shouldReceive('handle')->once();
+    GetProxyConfiguration::partialMock()->shouldReceive('handle')->once()->andReturn("services:\n  traefik:\n    command: []\n");
+    SaveProxyConfiguration::partialMock()->shouldReceive('handle')->once()->withArgs(
+        fn (Server $server, string $configuration): bool => str_contains($configuration, '--accesslog=true')
+    );
+
+    $server = trafficAnalyticsProxyServer($this, 'TRAEFIK', $proxy);
+
+    expect(ConfigureTrafficAnalytics::run($server, true))->toBeFalse();
+
+    expect($server->fresh()->isTrafficAnalyticsEnabled())->toBeTrue()
+        ->and((bool) $server->fresh()->proxy->get('force_stop'))->toBe((bool) ($proxy['force_stop'] ?? false));
+    Queue::assertNotPushed(RestartProxyJob::class);
+})->with([
+    'force stopped' => [['status' => 'running', 'force_stop' => true]],
+    'exited' => [['status' => 'exited']],
+    'stopped' => [['status' => 'stopped']],
+]);
+
+it('restarts a running proxy to apply the configuration', function (string $proxyType) {
+    Queue::fake();
+    StartSentinel::partialMock()->shouldReceive('handle')->once();
+    GetProxyConfiguration::partialMock()->shouldReceive('handle')->once()->andReturn($proxyType === 'CADDY'
+        ? "services:\n  caddy:\n    volumes: []\n"
+        : "services:\n  traefik:\n    command: []\n");
+    SaveProxyConfiguration::partialMock()->shouldReceive('handle')->once();
+
+    $server = trafficAnalyticsProxyServer($this, $proxyType, ['status' => 'running', 'force_stop' => false]);
+
+    expect(ConfigureTrafficAnalytics::run($server, true))->toBeTrue();
+
+    expect($server->fresh()->isTrafficAnalyticsEnabled())->toBeTrue();
+    Queue::assertPushed(RestartProxyJob::class);
+})->with(['TRAEFIK', 'CADDY']);
diff --git a/tests/Feature/TrafficAnalytics/ResourceTrafficKeysTest.php b/tests/Feature/TrafficAnalytics/ResourceTrafficKeysTest.php
new file mode 100644
index 0000000000..7299f5c923
--- /dev/null
+++ b/tests/Feature/TrafficAnalytics/ResourceTrafficKeysTest.php
@@ -0,0 +1,426 @@
+<?php
+
+use App\Data\Traffic\TrafficBreakdownData;
+use App\Data\Traffic\TrafficOverviewData;
+use App\Data\Traffic\TrafficPathData;
+use App\Data\Traffic\TrafficSeriesBucketData;
+use App\Livewire\Analytics as GlobalAnalytics;
+use App\Livewire\Project\Application\Analytics as ApplicationAnalytics;
+use App\Livewire\Project\Application\TrafficOverview;
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\PrivateKey;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\Service;
+use App\Models\ServiceApplication;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Models\User;
+use App\Services\SentinelTrafficClient;
+use App\Services\TrafficAnalyticsAggregator;
+use App\Services\TrafficResource;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Cache;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+/**
+ * Serves canned bodies by the first needle contained in the url, in insertion order, so
+ * per-key needles (e.g. "/app/{key}/traffic/overview") must come before generic ones.
+ */
+class FakeResourceKeysTrafficClient extends SentinelTrafficClient
+{
+    public array $responses = [];
+
+    protected function raw(string $url): string
+    {
+        foreach ($this->responses as $needle => $response) {
+            if (str_contains($url, $needle)) {
+                if ($response instanceof Throwable) {
+                    throw $response;
+                }
+
+                return $response;
+            }
+        }
+
+        return '{}';
+    }
+}
+
+function resourceKeysOverview(int $requests, int $uniques = 10, float $p95 = 20.0): string
+{
+    return json_encode([
+        'requests' => $requests,
+        'bytes_in' => $requests * 10,
+        'bytes_out' => $requests * 100,
+        'status' => ['s2xx' => $requests, 's3xx' => 0, 's4xx' => 0, 's5xx' => 0],
+        'latency' => ['p50' => 5.0, 'p95' => $p95, 'p99' => 50.0],
+        'unique_visitors' => $uniques,
+    ]);
+}
+
+function bindResourceKeysFake(array $responses): void
+{
+    app()->bind(SentinelTrafficClient::class, function ($app, $params) use ($responses) {
+        $client = new FakeResourceKeysTrafficClient($params['server']);
+        $client->responses = $responses;
+
+        return $client;
+    });
+}
+
+beforeEach(function () {
+    Cache::flush();
+    Server::flushIdentityMap();
+
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+    $this->actingAs($this->user);
+    session(['currentTeam' => $this->team]);
+
+    $this->privateKey = PrivateKey::factory()->create(['team_id' => $this->team->id]);
+    $this->server = Server::factory()->create([
+        'team_id' => $this->team->id,
+        'private_key_id' => $this->privateKey->id,
+    ]);
+    $this->server->settings->is_traffic_analytics_enabled = true;
+    $this->server->settings->save();
+    $this->destination = StandaloneDocker::where('server_id', $this->server->id)->first()
+        ?? StandaloneDocker::factory()->create(['server_id' => $this->server->id, 'network' => 'coolify-test']);
+
+    $this->project = Project::factory()->create(['team_id' => $this->team->id, 'name' => 'Storefront']);
+    $this->environment = Environment::factory()->create(['project_id' => $this->project->id]);
+});
+
+function makeComposeApplication(): Application
+{
+    return Application::factory()->create([
+        'name' => 'Compose Shop',
+        'build_pack' => 'dockercompose',
+        'fqdn' => null,
+        'docker_compose_domains' => json_encode([
+            'api' => ['domain' => 'https://api.shop.test'],
+            'web' => ['domain' => 'https://www.shop.test'],
+        ]),
+        'environment_id' => test()->environment->id,
+        'destination_id' => test()->destination->id,
+        'destination_type' => StandaloneDocker::class,
+    ]);
+}
+
+function makeTrafficService(Server $server, StandaloneDocker $destination, Environment $environment, string $name, string $fqdn): Service
+{
+    $service = Service::factory()->create([
+        'name' => $name,
+        'server_id' => $server->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+        'environment_id' => $environment->id,
+    ]);
+    ServiceApplication::create([
+        'service_id' => $service->id,
+        'name' => 'web',
+        'image' => 'nginx:alpine',
+        'fqdn' => $fqdn,
+    ]);
+
+    return $service;
+}
+
+it('resolves the bare uuid and every uuid-prefixed key, without false prefix matches', function () {
+    $client = new FakeResourceKeysTrafficClient($this->server);
+    $client->responses = ['/traffic/apps' => json_encode([
+        'abc', 'abc-api-1a2b', 'abc-12', 'abcx', 'abcd-web', 'xabc', 'other', 'abc-bad key', 42,
+    ])];
+
+    expect($client->resourceKeys('abc'))->toBe(['abc', 'abc-12', 'abc-api-1a2b'])
+        ->and($client->resourceKeys('zzz'))->toBe(['zzz'])
+        ->and(SentinelTrafficClient::keyBelongsTo('abcx', 'abc'))->toBeFalse()
+        ->and(SentinelTrafficClient::keyBelongsTo('abc-web', 'abc'))->toBeTrue()
+        ->and(SentinelTrafficClient::candidateOwnerUuids('abc-12-web'))->toBe(['abc-12-web', 'abc-12', 'abc']);
+
+    expect(fn () => $client->resourceKeys("x'; touch /tmp/pwned; '"))->toThrow(InvalidArgumentException::class);
+});
+
+it('falls back to the bare uuid when the recorded key list is unavailable', function () {
+    $client = new FakeResourceKeysTrafficClient($this->server);
+    $client->responses = ['/traffic/apps' => new RuntimeException('unreachable')];
+
+    expect($client->resourceKeys('abc'))->toBe(['abc']);
+});
+
+it('warms the key list and every key bundle in two batched execs', function () {
+    $client = new class($this->server) extends SentinelTrafficClient
+    {
+        public array $batches = [];
+
+        protected function batchRemoteFetch(array $urls): string
+        {
+            $this->batches[] = $urls;
+
+            return implode("\x1e", array_map(fn ($url) => match (true) {
+                str_contains($url, '/traffic/apps') => json_encode(['res', 'res-api', 'res-web', 'other']),
+                str_contains($url, '/app/res-api/traffic/dashboard') => json_encode(['overview' => ['requests' => 7], 'paths' => [], 'breakdowns' => [], 'series' => [], 'attribution' => null]),
+                str_contains($url, '/traffic/dashboard') => json_encode(['overview' => ['requests' => 1], 'paths' => [], 'breakdowns' => [], 'series' => [], 'attribution' => null]),
+                default => '[]',
+            }, $urls))."\x1e";
+        }
+
+        protected function remoteFetch(string $url): string
+        {
+            throw new RuntimeException("individual fetch should not run for: {$url}");
+        }
+    };
+
+    $keys = $client->prefetchResource('res', 'F', 'T', ['country'], '24h');
+
+    expect($keys)->toBe(['res', 'res-api', 'res-web'])
+        ->and($client->batches)->toHaveCount(2)
+        // The bare-uuid bundle came with the key list; only the other two are fetched.
+        ->and($client->batches[1])->toHaveCount(2);
+    // Served from the seeded cache; remoteFetch() would throw otherwise.
+    expect($client->overview('res-api', 'F', 'T')->requests)->toBe(7)
+        ->and($client->overview('res-web', 'F', 'T')->requests)->toBe(1);
+    $client->breakdown('res-web', 'country', 'F', 'T');
+});
+
+it('batches the individual endpoints of every key when Sentinel lacks the dashboard route', function () {
+    $client = new class($this->server) extends SentinelTrafficClient
+    {
+        public int $batchCalls = 0;
+
+        protected function batchRemoteFetch(array $urls): string
+        {
+            $this->batchCalls++;
+
+            return implode("\x1e", array_map(fn ($url) => match (true) {
+                str_contains($url, '/traffic/apps') => json_encode(['res-api', 'res-web']),
+                str_contains($url, '/traffic/dashboard') => 'Not Found',
+                str_contains($url, '/attribution') => '{"attribution":"demo"}',
+                str_contains($url, '/overview') => '{"requests":3}',
+                default => '[]',
+            }, $urls))."\x1e";
+        }
+
+        protected function remoteFetch(string $url): string
+        {
+            throw new RuntimeException("individual fetch should not run for: {$url}");
+        }
+    };
+
+    $keys = $client->prefetchResource('res', 'F', 'T', ['country'], '24h');
+
+    expect($keys)->toBe(['res-api', 'res-web'])
+        ->and($client->batchCalls)->toBe(3)
+        ->and($client->overview('res-api', 'F', 'T')->requests)->toBe(3)
+        ->and($client->overview('res-web', 'F', 'T')->requests)->toBe(3)
+        ->and($client->attribution())->toBe('demo');
+});
+
+it('merges overviews, paths, breakdowns, and series of several keys', function () {
+    $aggregator = new TrafficAnalyticsAggregator(['country']);
+
+    $aggregator->addOverview(TrafficOverviewData::fromSentinel(json_decode(resourceKeysOverview(100, 10, 20.0), true)));
+    $aggregator->addOverview(TrafficOverviewData::fromSentinel(json_decode(resourceKeysOverview(50, 5, 40.0), true)));
+
+    $domains = ['k-api' => 'api.test', 'k-web' => 'web.test'];
+    $domainForKey = fn (string $key) => $domains[$key] ?? null;
+    $aggregator->addPaths(collect([
+        TrafficPathData::fromSentinel(['path' => '/', 'app' => 'k-api', 'requests' => 10, 'p95' => 5]),
+        TrafficPathData::fromSentinel(['path' => '/', 'app' => 'k-api', 'requests' => 5, 'p95' => 9]),
+    ]), 'k-api', $domainForKey);
+    // Older Sentinel omits `app`: the queried key is the fallback.
+    $aggregator->addPaths(collect([TrafficPathData::fromSentinel(['path' => '/', 'requests' => 30])]), 'k-web', $domainForKey);
+
+    $aggregator->addBreakdown('country', collect([TrafficBreakdownData::fromSentinel(['value' => 'US', 'requests' => 4, 'bytes_out' => 1])]));
+    $aggregator->addBreakdown('country', collect([TrafficBreakdownData::fromSentinel(['value' => 'US', 'requests' => 6, 'bytes_out' => 2])]));
+
+    $aggregator->addSeries(collect([TrafficSeriesBucketData::fromSentinel(['bucket' => 2000, 's2xx' => 1]), TrafficSeriesBucketData::fromSentinel(['bucket' => 1000, 's2xx' => 2])]));
+    $aggregator->addSeries(collect([TrafficSeriesBucketData::fromSentinel(['bucket' => 1000, 's2xx' => 3])]));
+
+    $overview = $aggregator->overview();
+    expect($overview['overview']->requests)->toBe(150)
+        ->and($overview['overview']->uniqueVisitors)->toBe(15)
+        ->and($overview['overview']->latencyP95)->toBe(40.0)
+        ->and($overview['latencyApproximate'])->toBeTrue()
+        ->and($overview['uniquesApproximate'])->toBeTrue();
+
+    $paths = $aggregator->topPaths();
+    expect($paths)->toHaveCount(2)
+        ->and($paths[0])->toMatchArray(['path' => '/', 'domain' => 'web.test', 'requests' => 30])
+        ->and($paths[1])->toMatchArray(['path' => '/', 'domain' => 'api.test', 'requests' => 15, 'p95' => 9.0]);
+
+    expect($aggregator->breakdowns()['country'])->toBe([['value' => 'US', 'requests' => 10, 'bytesOut' => 3]]);
+    expect(array_column($aggregator->series(), 'bucket'))->toBe([1000, 2000])
+        ->and($aggregator->series()[0]['s2xx'])->toBe(5);
+});
+
+it('shows a compose application with the data of all its compose service keys', function () {
+    $application = makeComposeApplication();
+    $apiKey = $application->uuid.'-'.traefikSafeServiceNameSegment('api');
+    $webKey = $application->uuid.'-'.traefikSafeServiceNameSegment('web');
+
+    bindResourceKeysFake([
+        '/traffic/apps' => json_encode([$apiKey, $webKey, 'someone-else']),
+        "/app/{$apiKey}/traffic/overview" => resourceKeysOverview(100),
+        "/app/{$webKey}/traffic/overview" => resourceKeysOverview(50),
+        "/app/{$apiKey}/traffic/paths" => json_encode([['path' => '/v1/orders', 'app' => $apiKey, 'requests' => 100]]),
+        "/app/{$webKey}/traffic/paths" => json_encode([['path' => '/checkout', 'app' => $webKey, 'requests' => 50]]),
+        "/app/{$application->uuid}/traffic" => new RuntimeException('bare uuid must not be queried when compose keys exist'),
+    ]);
+
+    $component = loadLazy(Livewire::test(ApplicationAnalytics::class, ['application' => $application]))
+        ->assertOk()
+        ->assertSee('150')
+        ->assertSee('api.shop.test')
+        ->assertSee('www.shop.test')
+        ->assertSet('uniquesApproximate', true);
+
+    $paths = collect($component->instance()->topPaths)->keyBy('path');
+    expect($component->instance()->overview['requests'])->toBe(150)
+        ->and($paths['/v1/orders']['domain'])->toBe('api.shop.test')
+        ->and($paths['/checkout']['domain'])->toBe('www.shop.test');
+});
+
+it('sums every compose key in the application traffic card', function () {
+    $application = makeComposeApplication();
+    $apiKey = $application->uuid.'-'.traefikSafeServiceNameSegment('api');
+    $webKey = $application->uuid.'-'.traefikSafeServiceNameSegment('web');
+
+    bindResourceKeysFake([
+        '/traffic/apps' => json_encode([$apiKey, $webKey]),
+        "/app/{$apiKey}/traffic/overview" => resourceKeysOverview(4000),
+        "/app/{$webKey}/traffic/overview" => resourceKeysOverview(200),
+    ]);
+
+    loadLazy(Livewire::test(TrafficOverview::class, ['application' => $application]))
+        ->assertOk()
+        ->assertSee('4,200');
+});
+
+it('groups compose keys of one application into one leaderboard row', function () {
+    $application = makeComposeApplication();
+    $apiKey = $application->uuid.'-'.traefikSafeServiceNameSegment('api');
+    $webKey = $application->uuid.'-'.traefikSafeServiceNameSegment('web');
+
+    bindResourceKeysFake([
+        '/traffic/apps' => json_encode([$apiKey, $webKey, 'orphan-key']),
+        "/app/{$apiKey}/traffic/overview" => resourceKeysOverview(100),
+        "/app/{$webKey}/traffic/overview" => resourceKeysOverview(50),
+        '/app/orphan-key/traffic/overview' => resourceKeysOverview(5),
+        '/traffic/overview' => resourceKeysOverview(155),
+        '/traffic/paths' => json_encode([['path' => '/v1', 'app' => $apiKey, 'requests' => 9]]),
+    ]);
+
+    $instance = loadLazy(Livewire::test(GlobalAnalytics::class))
+        ->assertOk()
+        ->assertSee('Compose Shop')
+        ->assertDontSee($apiKey)
+        ->instance();
+
+    $rows = collect($instance->topApps)->keyBy('uuid');
+    expect($rows)->toHaveCount(2)
+        ->and($rows[$application->uuid]['name'])->toBe('Compose Shop')
+        ->and($rows[$application->uuid]['requests'])->toBe(150)
+        ->and($rows[$application->uuid]['link'])->toBe(route('project.application.analytics', [
+            'project_uuid' => $this->project->uuid,
+            'environment_uuid' => $this->environment->uuid,
+            'application_uuid' => $application->uuid,
+        ]))
+        ->and($rows['orphan-key']['name'])->toBe('orphan-key')
+        ->and($rows['orphan-key']['link'])->toBeNull();
+
+    // Hosts stay per served domain; path rows carry the compose service domain.
+    $hosts = collect($instance->topHosts)->keyBy('host');
+    expect($hosts['api.shop.test']['requests'])->toBe(100)
+        ->and($hosts['www.shop.test']['requests'])->toBe(50)
+        ->and($instance->topPaths[0]['domain'])->toBe('api.shop.test');
+});
+
+it('lists services in the filter, links service rows to service analytics, and queries all service keys', function () {
+    $service = makeTrafficService($this->server, $this->destination, $this->environment, 'Umami', 'https://stats.shop.test');
+    $serviceKey = $service->uuid.'-'.traefikSafeServiceNameSegment('web');
+
+    bindResourceKeysFake([
+        '/traffic/apps' => json_encode([$serviceKey]),
+        "/app/{$serviceKey}/traffic/overview" => resourceKeysOverview(70),
+        '/traffic/overview' => resourceKeysOverview(70),
+    ]);
+
+    $component = loadLazy(Livewire::test(GlobalAnalytics::class))
+        ->assertOk()
+        ->assertSee('Umami');
+
+    $serviceLink = route('project.service.analytics', [
+        'project_uuid' => $this->project->uuid,
+        'environment_uuid' => $this->environment->uuid,
+        'service_uuid' => $service->uuid,
+    ]);
+    $row = $component->instance()->topApps[0];
+    expect($row['uuid'])->toBe($service->uuid)
+        ->and($row['name'])->toBe('Umami')
+        ->and($row['isService'])->toBeTrue()
+        ->and($row['domain'])->toBe('stats.shop.test')
+        ->and($row['link'])->toBe($serviceLink);
+    $component->assertSee($serviceLink, false);
+
+    expect(collect($component->instance()->appGroupedOptions)->firstWhere('value', $service->uuid)['label'])->toBe('Umami (Service)');
+
+    $component->set('appUuid', $service->uuid)
+        ->assertSet('appUuid', $service->uuid)
+        ->assertDontSee('Top applications');
+    expect($component->instance()->overview['requests'])->toBe(70);
+});
+
+it('never names or links a key owned by another team resource', function () {
+    $otherTeam = Team::factory()->create();
+    $otherProject = Project::factory()->create(['team_id' => $otherTeam->id]);
+    $otherEnvironment = Environment::factory()->create(['project_id' => $otherProject->id]);
+    $otherServer = Server::factory()->create(['team_id' => $otherTeam->id]);
+    $otherDestination = StandaloneDocker::factory()->create(['server_id' => $otherServer->id, 'network' => 'other-team-test']);
+    $otherService = makeTrafficService($otherServer, $otherDestination, $otherEnvironment, 'Secret Other Service', 'https://secret.other.test');
+    $otherKey = $otherService->uuid.'-'.traefikSafeServiceNameSegment('web');
+
+    bindResourceKeysFake([
+        '/traffic/apps' => json_encode([$otherKey]),
+        '/traffic/overview' => resourceKeysOverview(10),
+    ]);
+
+    $component = loadLazy(Livewire::test(GlobalAnalytics::class))
+        ->assertOk()
+        ->assertDontSee('Secret Other Service')
+        ->assertDontSee('secret.other.test')
+        ->assertSee($otherKey);
+
+    expect($component->instance()->topApps[0]['link'])->toBeNull()
+        ->and($component->instance()->appOptions)->not->toHaveKey($otherService->uuid);
+
+    // A bookmarked filter for another team's service is dropped, not queried.
+    loadLazy(Livewire::withQueryParams(['app' => $otherService->uuid])->test(GlobalAnalytics::class))
+        ->assertSet('appUuid', '');
+});
+
+it('finds the preview domain for normal and compose preview keys', function () {
+    $application = Application::factory()->create([
+        'fqdn' => 'https://shop.test',
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => StandaloneDocker::class,
+    ]);
+    $application->previews()->create([
+        'pull_request_id' => 12,
+        'pull_request_html_url' => 'https://github.com/coollabsio/shop/pull/12',
+        'fqdn' => 'https://12.shop.test',
+        'docker_compose_domains' => json_encode(['api' => ['domain' => 'https://api-12.shop.test']]),
+    ]);
+    $resource = TrafficResource::for($application->fresh());
+
+    expect($resource->domainForKey("{$application->uuid}-pr-12"))->toBe('12.shop.test')
+        ->and($resource->domainForKey("{$application->uuid}-12"))->toBe('12.shop.test')
+        ->and($resource->domainForKey("{$application->uuid}-12-api"))->toBe('api-12.shop.test')
+        ->and($resource->domainForKey($application->uuid))->toBe('shop.test');
+});
diff --git a/tests/Feature/TrafficAnalytics/ServiceAnalyticsTest.php b/tests/Feature/TrafficAnalytics/ServiceAnalyticsTest.php
new file mode 100644
index 0000000000..09de3c8e98
--- /dev/null
+++ b/tests/Feature/TrafficAnalytics/ServiceAnalyticsTest.php
@@ -0,0 +1,175 @@
+<?php
+
+use App\Livewire\Project\Service\Analytics as ServiceAnalytics;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\PrivateKey;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\Service;
+use App\Models\ServiceApplication;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Models\User;
+use App\Services\SentinelTrafficClient;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Once;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+class FakeServiceAnalyticsTrafficClient extends SentinelTrafficClient
+{
+    public array $responses = [];
+
+    protected function raw(string $url): string
+    {
+        foreach ($this->responses as $needle => $response) {
+            if (str_contains($url, $needle)) {
+                return $response;
+            }
+        }
+
+        return '{}';
+    }
+}
+
+function serviceAnalyticsOverview(int $requests): string
+{
+    return json_encode([
+        'requests' => $requests,
+        'bytes_in' => 100,
+        'bytes_out' => 900,
+        'status' => ['s2xx' => $requests, 's3xx' => 0, 's4xx' => 0, 's5xx' => 0],
+        'latency' => ['p50' => 5.0, 'p95' => 12.0, 'p99' => 30.0],
+        'unique_visitors' => 3,
+    ]);
+}
+
+/**
+ * @return array{server: Server, project: Project, environment: Environment, service: Service}
+ */
+function makeServiceAnalyticsStack(Team $team, bool $enabled, string $name): array
+{
+    $privateKey = PrivateKey::factory()->create(['team_id' => $team->id]);
+    $server = Server::factory()->create(['team_id' => $team->id, 'private_key_id' => $privateKey->id]);
+    $server->settings->is_traffic_analytics_enabled = $enabled;
+    $server->settings->save();
+    $destination = StandaloneDocker::where('server_id', $server->id)->first()
+        ?? StandaloneDocker::factory()->create(['server_id' => $server->id, 'network' => 'coolify-test-'.$team->id]);
+
+    $project = Project::factory()->create(['team_id' => $team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+    $service = Service::factory()->create([
+        'name' => $name,
+        'server_id' => $server->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+        'environment_id' => $environment->id,
+    ]);
+    foreach (['web' => 'https://app.svc.test', 'admin' => 'https://admin.svc.test'] as $serviceName => $fqdn) {
+        ServiceApplication::create([
+            'service_id' => $service->id,
+            'name' => $serviceName,
+            'image' => 'nginx:alpine',
+            'fqdn' => $fqdn,
+        ]);
+    }
+
+    return compact('server', 'project', 'environment', 'service');
+}
+
+function serviceAnalyticsRoute(array $stack): string
+{
+    return route('project.service.analytics', [
+        'project_uuid' => $stack['project']->uuid,
+        'environment_uuid' => $stack['environment']->uuid,
+        'service_uuid' => $stack['service']->uuid,
+    ]);
+}
+
+beforeEach(function () {
+    config()->set('app.maintenance.store', 'array');
+    Cache::flush();
+    Once::flush();
+    Server::flushIdentityMap();
+    InstanceSettings::forceCreate(['id' => 0]);
+
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+    $this->actingAs($this->user);
+    session(['currentTeam' => $this->team]);
+});
+
+it('renders the service analytics page with the disabled state and a navigation item', function () {
+    $stack = makeServiceAnalyticsStack($this->team, false, 'Umami');
+
+    $this->get(serviceAnalyticsRoute($stack))
+        ->assertOk()
+        ->assertSee('Traffic analytics is not enabled')
+        ->assertSee(serviceAnalyticsRoute($stack), false)
+        ->assertSee(route('server.analytics', ['server_uuid' => $stack['server']->uuid]), false)
+        ->assertDontSee('__lazyLoad', escape: false);
+});
+
+it('lazy loads the service analytics page when traffic analytics is enabled', function () {
+    $stack = makeServiceAnalyticsStack($this->team, true, 'Umami');
+
+    $this->get(serviceAnalyticsRoute($stack))
+        ->assertOk()
+        ->assertSee('__lazyLoad', escape: false);
+});
+
+it('merges the traffic of every service application key', function () {
+    $stack = makeServiceAnalyticsStack($this->team, true, 'Umami');
+    $service = $stack['service'];
+    $webKey = $service->uuid.'-'.traefikSafeServiceNameSegment('web');
+    $adminKey = $service->uuid.'-'.traefikSafeServiceNameSegment('admin');
+
+    app()->bind(SentinelTrafficClient::class, function ($app, $params) use ($webKey, $adminKey) {
+        $client = new FakeServiceAnalyticsTrafficClient($params['server']);
+        $client->responses = [
+            '/traffic/apps' => json_encode([$webKey, $adminKey, 'unrelated']),
+            "/app/{$webKey}/traffic/overview" => serviceAnalyticsOverview(300),
+            "/app/{$adminKey}/traffic/overview" => serviceAnalyticsOverview(20),
+            "/app/{$adminKey}/traffic/paths" => json_encode([['path' => '/login', 'app' => $adminKey, 'requests' => 20]]),
+        ];
+
+        return $client;
+    });
+
+    $component = loadLazy(Livewire::test(ServiceAnalytics::class, ['service' => $service]))
+        ->assertOk()
+        ->assertSee('320')
+        ->assertSee('admin.svc.test')
+        ->assertSet('latencyApproximate', true)
+        ->assertDispatched('refreshChartData-service-analytics-status');
+
+    expect($component->instance()->overview['requests'])->toBe(320)
+        ->and($component->instance()->topPaths[0]['domain'])->toBe('admin.svc.test');
+});
+
+it('returns not found for another team service analytics page', function () {
+    $otherTeam = Team::factory()->create();
+    $other = makeServiceAnalyticsStack($otherTeam, true, 'Secret Other Service');
+    $own = makeServiceAnalyticsStack($this->team, true, 'Umami');
+
+    $this->get(serviceAnalyticsRoute($other))->assertNotFound();
+
+    // Own project path with the other team's service uuid.
+    $this->get(route('project.service.analytics', [
+        'project_uuid' => $own['project']->uuid,
+        'environment_uuid' => $own['environment']->uuid,
+        'service_uuid' => $other['service']->uuid,
+    ]))->assertNotFound()->assertDontSee('Secret Other Service');
+});
+
+it('forbids the service analytics component for another team service', function () {
+    $otherTeam = Team::factory()->create();
+    $other = makeServiceAnalyticsStack($otherTeam, false, 'Secret Other Service');
+
+    Livewire::test(ServiceAnalytics::class, ['service' => $other['service'], 'lazy' => false])
+        ->assertForbidden();
+});
diff --git a/tests/Feature/TrafficAnalytics/StartSentinelTrafficTest.php b/tests/Feature/TrafficAnalytics/StartSentinelTrafficTest.php
index b8856f4c67..b85fbd86de 100644
--- a/tests/Feature/TrafficAnalytics/StartSentinelTrafficTest.php
+++ b/tests/Feature/TrafficAnalytics/StartSentinelTrafficTest.php
@@ -1,10 +1,17 @@
 <?php
 
 use App\Actions\Server\StartSentinel;
+use App\Enums\ServerRole;
+use App\Events\SentinelRestarted;
+use App\Models\InstanceSettings;
+use App\Models\PrivateKey;
 use App\Models\Server;
 use App\Models\User;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Event;
+use Illuminate\Support\Facades\Process;
 use Illuminate\Support\Facades\Queue;
+use Symfony\Component\Process\Process as SymfonyProcess;
 
 uses(RefreshDatabase::class);
 
@@ -22,7 +29,7 @@ it('produces no traffic env when disabled', function () {
 });
 
 it('produces traffic + geoip env when enabled', function () {
-    $server = Server::factory()->create(['team_id' => $this->team->id]);
+    $server = trafficProxyServer($this);
     $server->settings->is_traffic_analytics_enabled = true;
     $server->settings->geoip_maxmind_license_key = 'lic';
     $server->settings->save();
@@ -42,7 +49,7 @@ it('produces traffic + geoip env when enabled', function () {
 
 it('uses the dev proxy volume for traffic logs locally', function () {
     config()->set('app.env', 'local');
-    $server = Server::factory()->create(['team_id' => $this->team->id]);
+    $server = trafficProxyServer($this);
     $server->settings->is_traffic_analytics_enabled = true;
     $server->settings->save();
 
@@ -53,7 +60,7 @@ it('uses the dev proxy volume for traffic logs locally', function () {
 });
 
 it('passes custom traffic settings as sentinel env', function () {
-    $server = Server::factory()->create(['team_id' => $this->team->id]);
+    $server = trafficProxyServer($this);
     $server->settings->is_traffic_analytics_enabled = true;
     $server->settings->traffic_topn = 100;
     $server->settings->traffic_sample_threshold = 500;
@@ -76,7 +83,7 @@ it('passes custom traffic settings as sentinel env', function () {
 });
 
 it('injects the maxmind license key only when geoip is enabled', function () {
-    $server = Server::factory()->create(['team_id' => $this->team->id]);
+    $server = trafficProxyServer($this);
     $server->settings->is_traffic_analytics_enabled = true;
     $server->settings->is_geoip_enabled = true;
     $server->settings->geoip_maxmind_license_key = 'secret-maxmind-key';
@@ -85,3 +92,117 @@ it('injects the maxmind license key only when geoip is enabled', function () {
     $env = StartSentinel::sentinelTrafficEnvironment($server->fresh());
     expect($env['GEOIP_MAXMIND_LICENSE_KEY'])->toBe('secret-maxmind-key');
 });
+
+function trafficProxyServer(object $test): Server
+{
+    $server = Server::factory()->create(['team_id' => $test->team->id]);
+    $server->proxy->set('type', 'TRAEFIK');
+    $server->save();
+
+    return $server;
+}
+
+function sentinelTrafficServer(object $test, ?string $proxyType, bool $analyticsEnabled): Server
+{
+    $server = Server::factory()->create([
+        'team_id' => $test->team->id,
+        'private_key_id' => PrivateKey::factory()->create(['team_id' => $test->team->id])->id,
+    ]);
+    $server->proxy->set('type', $proxyType);
+    $server->save();
+    $server->settings->is_traffic_analytics_enabled = $analyticsEnabled;
+    $server->settings->sentinel_custom_url = 'https://coolify.example.com';
+    $server->settings->save();
+
+    return $server->fresh();
+}
+
+/**
+ * Runs StartSentinel against a faked SSH process and returns the remote script it sent.
+ */
+function runStartSentinelAndCaptureScript(Server $server): string
+{
+    if (! InstanceSettings::query()->whereKey(0)->exists()) {
+        InstanceSettings::forceCreate(['id' => 0]);
+    }
+    config(['constants.ssh.mux_enabled' => false]);
+    Event::fake([SentinelRestarted::class]);
+    $scripts = [];
+    Process::fake(function ($process) use (&$scripts) {
+        $scripts[] = is_array($process->command) ? implode(' ', $process->command) : $process->command;
+
+        return Process::result(output: '');
+    });
+
+    StartSentinel::run($server, latestVersion: '1.0.1');
+
+    return collect($scripts)->first(fn (string $script): bool => str_contains($script, 'docker run -d'));
+}
+
+it('creates the access log before starting sentinel with traffic analytics', function (string $proxyType, string $directory) {
+    $server = sentinelTrafficServer($this, $proxyType, analyticsEnabled: true);
+
+    expect(StartSentinel::trafficLogPreparationCommands($server))->toBe([
+        'mkdir -p '.escapeshellarg($directory),
+        'touch '.escapeshellarg($directory.'/access.log'),
+    ]);
+
+    $script = runStartSentinelAndCaptureScript($server);
+    $touch = 'touch '.escapeshellarg($directory.'/access.log');
+
+    expect($script)->toContain('mkdir -p '.escapeshellarg($directory))
+        ->toContain($touch)
+        ->not->toContain('> '.$directory.'/access.log')
+        ->and(strpos($script, 'mkdir -p '.escapeshellarg($directory)))->toBeLessThan(strpos($script, $touch))
+        ->and(strpos($script, $touch))->toBeLessThan(strpos($script, 'docker run -d'));
+})->with([
+    'traefik' => ['TRAEFIK', '/data/coolify/proxy'],
+    'caddy' => ['CADDY', '/data/coolify/proxy/caddy'],
+]);
+
+it('does not touch the access log when traffic analytics cannot run', function (?string $proxyType, bool $analyticsEnabled) {
+    $server = sentinelTrafficServer($this, $proxyType, $analyticsEnabled);
+
+    expect(StartSentinel::trafficLogPreparationCommands($server))->toBe([]);
+
+    $script = runStartSentinelAndCaptureScript($server);
+
+    expect($script)->toContain('docker run -d')
+        ->not->toContain('touch ')
+        ->not->toContain('/data/coolify/proxy:/data/coolify/proxy')
+        ->not->toContain('TRAFFIC_ENABLED');
+})->with([
+    'analytics disabled' => ['TRAEFIK', false],
+    'proxy none' => ['NONE', true],
+]);
+
+it('does not touch the access log on swarm or build servers', function (string $setting, mixed $value) {
+    $server = sentinelTrafficServer($this, 'TRAEFIK', analyticsEnabled: true);
+    $server->settings->{$setting} = $value;
+    $server->settings->save();
+
+    expect(StartSentinel::trafficLogPreparationCommands($server->fresh()))->toBe([]);
+})->with([
+    'swarm' => ['is_swarm_manager', true],
+    'build' => ['server_role', ServerRole::BUILD],
+]);
+
+it('keeps the access log commands valid for non-root servers', function () {
+    $server = sentinelTrafficServer($this, 'TRAEFIK', analyticsEnabled: true);
+    $server->user = 'ubuntu';
+
+    $commands = parseCommandsByLineForSudo(collect(StartSentinel::trafficLogPreparationCommands($server)), $server);
+
+    expect($commands)->toBe([
+        "sudo mkdir -p '/data/coolify/proxy'",
+        "sudo touch '/data/coolify/proxy/access.log'",
+    ]);
+
+    $script = tempnam(sys_get_temp_dir(), 'sentinel-traffic');
+    file_put_contents($script, implode("\n", $commands)."\n");
+    $syntax = SymfonyProcess::fromShellCommandline('bash -n '.escapeshellarg($script));
+    $syntax->run();
+    unlink($script);
+
+    expect($syntax->isSuccessful())->toBeTrue($syntax->getErrorOutput());
+});
diff --git a/tests/Feature/TrafficAnalytics/ToggleTrafficAnalyticsTest.php b/tests/Feature/TrafficAnalytics/ToggleTrafficAnalyticsTest.php
index 63864aada1..24e8eb9825 100644
--- a/tests/Feature/TrafficAnalytics/ToggleTrafficAnalyticsTest.php
+++ b/tests/Feature/TrafficAnalytics/ToggleTrafficAnalyticsTest.php
@@ -1,6 +1,7 @@
 <?php
 
 use App\Actions\Server\ConfigureTrafficAnalytics;
+use App\Enums\ServerRole;
 use App\Livewire\Analytics;
 use App\Livewire\Server\TrafficAnalyticsSettings;
 use App\Models\InstanceSettings;
@@ -24,9 +25,13 @@ it('toggles traffic analytics via the sentinel settings component', function ()
     ConfigureTrafficAnalytics::partialMock()->shouldReceive('handle')->once()->andReturnUsing(function ($server, $enable) {
         $server->settings->is_traffic_analytics_enabled = $enable;
         $server->settings->save();
+
+        return true;
     });
 
     $server = Server::factory()->create(['team_id' => $this->team->id]);
+    $server->proxy->set('type', 'TRAEFIK');
+    $server->save();
     // New servers default analytics on; start from the disabled state to exercise enabling.
     $server->settings->is_traffic_analytics_enabled = false;
     $server->settings->save();
@@ -43,6 +48,8 @@ it('toggles traffic analytics via the sentinel settings component', function ()
 
 it('warns about the application interruption before enabling traffic analytics', function () {
     $server = Server::factory()->create(['team_id' => $this->team->id]);
+    $server->proxy->set('type', 'TRAEFIK');
+    $server->save();
     $server->settings->is_traffic_analytics_enabled = false;
     $server->settings->save();
 
@@ -65,6 +72,8 @@ it('does not enable traffic analytics on a swarm server', function () {
     ConfigureTrafficAnalytics::partialMock()->shouldReceive('handle')->never();
 
     $server = Server::factory()->create(['team_id' => $this->team->id]);
+    $server->proxy->set('type', 'TRAEFIK');
+    $server->save();
     $server->settings->is_swarm_manager = true;
     $server->settings->is_traffic_analytics_enabled = false;
     $server->settings->save();
@@ -73,6 +82,7 @@ it('does not enable traffic analytics on a swarm server', function () {
 
     Livewire::test(TrafficAnalyticsSettings::class, ['server' => $server])
         ->call('toggleTrafficAnalytics')
+        ->assertDispatched('error', 'Traffic analytics is not supported on Swarm/Build servers.')
         ->assertHasNoErrors();
 
     expect($server->fresh()->isTrafficAnalyticsEnabled())->toBeFalse();
@@ -117,7 +127,9 @@ it('does not enable traffic analytics on a build server', function () {
     ConfigureTrafficAnalytics::partialMock()->shouldReceive('handle')->never();
 
     $server = Server::factory()->create(['team_id' => $this->team->id]);
-    $server->settings->is_build_server = true;
+    $server->proxy->set('type', 'TRAEFIK');
+    $server->save();
+    $server->settings->server_role = ServerRole::BUILD;
     $server->settings->is_traffic_analytics_enabled = false;
     $server->settings->save();
 
@@ -125,7 +137,144 @@ it('does not enable traffic analytics on a build server', function () {
 
     Livewire::test(TrafficAnalyticsSettings::class, ['server' => $server])
         ->call('toggleTrafficAnalytics')
+        ->assertDispatched('error', 'Traffic analytics is not supported on Swarm/Build servers.')
         ->assertHasNoErrors();
 
     expect($server->fresh()->isTrafficAnalyticsEnabled())->toBeFalse();
 });
+
+it('disables the analytics toggle and explains why when the server has no traefik or caddy proxy', function () {
+    $server = Server::factory()->create(['team_id' => $this->team->id]);
+    $server->proxy->set('type', 'NONE');
+    $server->save();
+    $server->settings->is_traffic_analytics_enabled = false;
+    $server->settings->save();
+
+    $html = Livewire::test(TrafficAnalyticsSettings::class, ['server' => $server])
+        ->assertSee('Traffic analytics needs the Traefik or Caddy proxy.')
+        ->assertDontSee('Enable traffic analytics?')
+        ->assertDontSeeHtml('submitAction')
+        ->html();
+
+    expect($html)->toMatch('/<button disabled[^>]*>(?:\s|<!--.*?-->)*Enable traffic analytics\s*<\/button>/s');
+});
+
+it('rejects enabling analytics from the component when the server has no traefik or caddy proxy', function () {
+    ConfigureTrafficAnalytics::partialMock()->shouldReceive('handle')->never();
+
+    $server = Server::factory()->create(['team_id' => $this->team->id]);
+    $server->proxy->set('type', 'NONE');
+    $server->save();
+    $server->settings->is_traffic_analytics_enabled = false;
+    $server->settings->save();
+
+    Livewire::test(TrafficAnalyticsSettings::class, ['server' => $server])
+        ->call('toggleTrafficAnalytics')
+        ->assertDispatched('error', 'Traffic analytics needs the Traefik or Caddy proxy.')
+        ->assertSet('isTrafficAnalyticsEnabled', false);
+
+    expect($server->fresh()->isTrafficAnalyticsEnabled())->toBeFalse();
+});
+
+it('lets analytics be disabled on a server whose proxy was removed', function () {
+    ConfigureTrafficAnalytics::partialMock()->shouldReceive('handle')->once()->andReturnUsing(function ($server, $enable) {
+        $server->settings->is_traffic_analytics_enabled = $enable;
+        $server->settings->save();
+
+        return false;
+    });
+
+    $server = Server::factory()->create(['team_id' => $this->team->id]);
+    $server->proxy->set('type', 'NONE');
+    $server->save();
+    $server->settings->is_traffic_analytics_enabled = true;
+    $server->settings->save();
+
+    Livewire::test(TrafficAnalyticsSettings::class, ['server' => $server])
+        ->assertDontSee('Traffic analytics needs the Traefik or Caddy proxy.')
+        ->call('toggleTrafficAnalytics')
+        ->assertDispatched('success', 'Traffic analytics disabled.')
+        ->assertSet('isTrafficAnalyticsEnabled', false);
+});
+
+it('tells the user a stopped proxy picks up the change on its next start', function () {
+    ConfigureTrafficAnalytics::partialMock()->shouldReceive('handle')->once()->andReturnUsing(function ($server, $enable) {
+        $server->settings->is_traffic_analytics_enabled = $enable;
+        $server->settings->save();
+
+        return false;
+    });
+
+    $server = Server::factory()->create(['team_id' => $this->team->id]);
+    $server->proxy->set('type', 'TRAEFIK');
+    $server->proxy->set('status', 'exited');
+    $server->proxy->set('force_stop', true);
+    $server->save();
+    $server->settings->is_traffic_analytics_enabled = false;
+    $server->settings->save();
+
+    Livewire::test(TrafficAnalyticsSettings::class, ['server' => $server])
+        ->call('toggleTrafficAnalytics')
+        ->assertDispatched('success', 'Traffic analytics enabled. The proxy is stopped, so the new configuration applies the next time you start it.');
+});
+
+it('does not let a team member toggle traffic analytics', function () {
+    ConfigureTrafficAnalytics::partialMock()->shouldReceive('handle')->never();
+
+    $server = Server::factory()->create(['team_id' => $this->team->id]);
+    $server->proxy->set('type', 'TRAEFIK');
+    $server->save();
+    $server->settings->is_traffic_analytics_enabled = false;
+    $server->settings->save();
+
+    $member = User::factory()->create();
+    $this->team->members()->attach($member->id, ['role' => 'member']);
+    $this->actingAs($member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(TrafficAnalyticsSettings::class, ['server' => $server])
+        ->assertForbidden();
+
+    expect($server->fresh()->isTrafficAnalyticsEnabled())->toBeFalse();
+});
+
+it('tells the user that Caddy logs a resource only after a redeploy', function () {
+    ConfigureTrafficAnalytics::partialMock()->shouldReceive('handle')->once()->andReturnUsing(function ($server, $enable) {
+        $server->settings->is_traffic_analytics_enabled = $enable;
+        $server->settings->save();
+
+        return true;
+    });
+
+    $server = Server::factory()->create(['team_id' => $this->team->id]);
+    $server->proxy->set('type', 'CADDY');
+    $server->save();
+    $server->settings->is_traffic_analytics_enabled = false;
+    $server->settings->save();
+
+    Livewire::test(TrafficAnalyticsSettings::class, ['server' => $server])
+        ->assertDontSee('Caddy logs a resource only after you redeploy it.')
+        ->call('toggleTrafficAnalytics')
+        ->assertDispatched('success', 'Traffic analytics enabled. Restarting proxy and Sentinel. Caddy logs a resource only after you redeploy it.')
+        ->assertSee('Caddy logs a resource only after you redeploy it.');
+});
+
+it('does not show the Caddy redeploy note on a Traefik server', function () {
+    ConfigureTrafficAnalytics::partialMock()->shouldReceive('handle')->once()->andReturnUsing(function ($server, $enable) {
+        $server->settings->is_traffic_analytics_enabled = $enable;
+        $server->settings->save();
+
+        return true;
+    });
+
+    $server = Server::factory()->create(['team_id' => $this->team->id]);
+    $server->proxy->set('type', 'TRAEFIK');
+    $server->save();
+    $server->settings->is_traffic_analytics_enabled = false;
+    $server->settings->save();
+
+    Livewire::test(TrafficAnalyticsSettings::class, ['server' => $server])
+        ->call('toggleTrafficAnalytics')
+        ->assertDispatched('success', 'Traffic analytics enabled. Restarting proxy and Sentinel.')
+        ->assertDontSee('Caddy logs a resource only after you redeploy it.');
+});
diff --git a/tests/Feature/TrafficAnalytics/TraefikLogRotationScriptTest.php b/tests/Feature/TrafficAnalytics/TraefikLogRotationScriptTest.php
new file mode 100644
index 0000000000..e918bf8b4c
--- /dev/null
+++ b/tests/Feature/TrafficAnalytics/TraefikLogRotationScriptTest.php
@@ -0,0 +1,160 @@
+<?php
+
+use App\Models\PrivateKey;
+use App\Models\Server;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\File;
+use Illuminate\Support\Facades\Process as LaravelProcess;
+use Symfony\Component\Process\Process;
+use Symfony\Component\Yaml\Yaml;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    // generateDefaultProxyConfiguration() persists the config over SSH; the rotation script itself
+    // runs through Symfony Process below, which the Laravel fake does not intercept.
+    LaravelProcess::fake();
+
+    $user = User::factory()->create();
+    $team = $user->teams()->first();
+    $privateKey = PrivateKey::factory()->create(['team_id' => $team->id]);
+
+    $server = Server::factory()->create(['team_id' => $team->id, 'private_key_id' => $privateKey->id]);
+    $server->proxy->set('type', 'TRAEFIK');
+    $server->save();
+    $server->settings->is_traffic_analytics_enabled = true;
+    $server->settings->save();
+
+    $entrypoint = Yaml::parse(generateDefaultProxyConfiguration($server->fresh()))['services']['traefik-logrotate']['entrypoint'];
+
+    // Docker Compose turns `$$` into a literal `$` before the container runs the script.
+    $this->script = str_replace('$$', '$', $entrypoint[2]);
+    $this->directory = sys_get_temp_dir().'/coolify-logrotate-'.bin2hex(random_bytes(6));
+    File::ensureDirectoryExists($this->directory);
+    $this->log = $this->directory.'/access.log';
+});
+
+afterEach(function () {
+    File::deleteDirectory($this->directory);
+});
+
+/**
+ * @return array<int, string>
+ */
+function rotationScriptShells(): array
+{
+    $shells = ['/bin/sh'];
+    foreach (['/usr/bin/busybox', '/bin/busybox'] as $busybox) {
+        if (is_executable($busybox)) {
+            $shells[] = $busybox;
+            break;
+        }
+    }
+
+    return $shells;
+}
+
+/**
+ * Run the sidecar loop until $isDone() holds (or a timeout), then stop it.
+ *
+ * @param  array<string, string>  $env
+ */
+function runRotationScript(string $shell, string $script, string $log, callable $isDone, array $env = [], float $timeout = 20.0): void
+{
+    $command = str_ends_with($shell, 'busybox') ? [$shell, 'sh', '-c', $script] : [$shell, '-c', $script];
+    $process = new Process($command, null, ['TRAEFIK_ACCESS_LOG' => $log, ...$env]);
+    $process->start();
+
+    $deadline = microtime(true) + $timeout;
+    while (microtime(true) < $deadline && $process->isRunning()) {
+        clearstatcache();
+        if ($isDone()) {
+            break;
+        }
+        usleep(50_000);
+    }
+
+    $running = $process->isRunning();
+    $process->stop(0);
+
+    expect($running)->toBeTrue('The rotation loop exited: '.$process->getErrorOutput());
+}
+
+/**
+ * @return array<int, string>
+ */
+function rotatedAccessLogs(string $directory): array
+{
+    return collect(File::files($directory))
+        ->map(fn (SplFileInfo $file): string => $file->getFilename())
+        ->filter(fn (string $name): bool => str_starts_with($name, 'access.log.'))
+        ->sort()
+        ->values()
+        ->all();
+}
+
+it('rotates an access log larger than 20 MiB, truncates it in place and keeps at most 5 rotations', function (string $shell) {
+    $line = '{"ClientHost":"203.0.113.10","RequestPath":"/","DownstreamStatus":200}'."\n";
+    $content = str_repeat($line, intdiv(21 * 1024 * 1024, strlen($line)) + 1);
+    File::put($this->log, $content);
+    $inode = fileinode($this->log);
+
+    foreach (range(1, 5) as $index) {
+        File::put("{$this->log}.{$index}.gz", gzencode("rotation {$index}\n"));
+    }
+
+    runRotationScript($shell, $this->script, $this->log, fn (): bool => filesize($this->log) === 0
+        && ! file_exists("{$this->log}.1")
+        && file_exists("{$this->log}.1.gz"));
+
+    clearstatcache();
+
+    expect(filesize($this->log))->toBe(0)
+        ->and(fileinode($this->log))->toBe($inode)
+        ->and(rotatedAccessLogs($this->directory))->toBe([
+            'access.log.1.gz',
+            'access.log.2.gz',
+            'access.log.3.gz',
+            'access.log.4.gz',
+            'access.log.5.gz',
+        ])
+        ->and(gzdecode(File::get("{$this->log}.1.gz")) === $content)->toBeTrue()
+        ->and(gzdecode(File::get("{$this->log}.2.gz")))->toBe("rotation 1\n")
+        ->and(gzdecode(File::get("{$this->log}.5.gz")))->toBe("rotation 4\n");
+})->with(rotationScriptShells());
+
+it('shifts rotations on every run and never keeps more than 5', function (string $shell) {
+    foreach (range(1, 7) as $run) {
+        File::put($this->log, str_repeat("run {$run}\n", 64));
+
+        runRotationScript(
+            $shell,
+            $this->script,
+            $this->log,
+            fn (): bool => filesize($this->log) === 0 && ! file_exists("{$this->log}.1") && file_exists("{$this->log}.1.gz"),
+            ['TRAEFIK_ACCESS_LOG_MAX_BYTES' => '100'],
+        );
+
+        expect(count(rotatedAccessLogs($this->directory)))->toBe(min($run, 5));
+    }
+
+    expect(gzdecode(File::get("{$this->log}.1.gz")))->toStartWith('run 7')
+        ->and(gzdecode(File::get("{$this->log}.5.gz")))->toStartWith('run 3')
+        ->and(file_exists("{$this->log}.6.gz"))->toBeFalse();
+})->with(rotationScriptShells());
+
+it('leaves an access log under the size limit and a missing access log alone', function (string $shell) {
+    File::put($this->log, str_repeat("small\n", 1000));
+
+    runRotationScript($shell, $this->script, $this->log, fn (): bool => false, timeout: 1.0);
+
+    expect(filesize($this->log))->toBe(6000)
+        ->and(rotatedAccessLogs($this->directory))->toBe([]);
+
+    File::delete($this->log);
+
+    runRotationScript($shell, $this->script, $this->log, fn (): bool => false, timeout: 1.0);
+
+    expect(rotatedAccessLogs($this->directory))->toBe([]);
+})->with(rotationScriptShells());
diff --git a/tests/Feature/TrafficAnalytics/TraefikLogrotateSidecarTest.php b/tests/Feature/TrafficAnalytics/TraefikLogrotateSidecarTest.php
index de772fd110..d165ebb584 100644
--- a/tests/Feature/TrafficAnalytics/TraefikLogrotateSidecarTest.php
+++ b/tests/Feature/TrafficAnalytics/TraefikLogrotateSidecarTest.php
@@ -95,7 +95,7 @@ it('does not add a traefik-logrotate sidecar when traffic analytics is disabled'
     expect($config['services'])->not->toHaveKey('traefik-logrotate');
 });
 
-it('adds a traefik-logrotate sidecar with copytruncate and the proxy mount when enabled', function () {
+it('adds a traefik-logrotate sidecar with the proxy mount when enabled', function () {
     $server = Server::factory()->create(['team_id' => $this->team->id, 'private_key_id' => $this->privateKey->id]);
     $server->proxy->set('type', 'TRAEFIK');
     $server->save();
@@ -105,16 +105,52 @@ it('adds a traefik-logrotate sidecar with copytruncate and the proxy mount when
     $server = $server->fresh();
     $yaml = generateDefaultProxyConfiguration($server);
 
-    expect($yaml)->toContain('traefik-logrotate')
-        ->toContain('copytruncate');
+    expect($yaml)->toContain('traefik-logrotate');
 
     $config = Yaml::parse($yaml);
     $sidecar = $config['services']['traefik-logrotate'];
 
     expect($sidecar['container_name'])->toBe('coolify-proxy-logrotate');
-    expect($sidecar['image'])->toBe('alpine:3.20');
+    expect($sidecar['image'])->toBe('alpine:3.24');
+    expect($sidecar['network_mode'])->toBe('none');
     expect($sidecar['volumes'])->toContain($server->proxyPath().':/traefik');
     expect($sidecar['labels'])->toContain('coolify.managed=true');
-    expect($sidecar['entrypoint'])->toContain('copytruncate');
-    expect($sidecar['entrypoint'])->toContain('logrotate');
+    expect($sidecar['entrypoint'])->toHaveCount(3)
+        ->and($sidecar['entrypoint'][0])->toBe('/bin/sh')
+        ->and($sidecar['entrypoint'][1])->toBe('-c');
+});
+
+it('rotates the access log with busybox tools only, without installing packages', function () {
+    $server = Server::factory()->create(['team_id' => $this->team->id, 'private_key_id' => $this->privateKey->id]);
+    $server->proxy->set('type', 'TRAEFIK');
+    $server->save();
+    $server->settings->is_traffic_analytics_enabled = true;
+    $server->settings->save();
+
+    $yaml = generateDefaultProxyConfiguration($server->fresh());
+    $script = Yaml::parse($yaml)['services']['traefik-logrotate']['entrypoint'][2];
+
+    expect($yaml)->not->toContain('apk add')
+        ->not->toContain('apk ')
+        ->not->toContain('logrotate -s');
+
+    expect($script)->toContain('while true; do')
+        ->toContain('stat -c %s')
+        ->toContain('20971520')
+        ->toContain('keep=5')
+        ->toContain('gzip -f')
+        ->toContain(': > "$$log"');
+});
+
+it('escapes every dollar sign in the rotation script from docker compose interpolation', function () {
+    $server = Server::factory()->create(['team_id' => $this->team->id, 'private_key_id' => $this->privateKey->id]);
+    $server->proxy->set('type', 'TRAEFIK');
+    $server->save();
+    $server->settings->is_traffic_analytics_enabled = true;
+    $server->settings->save();
+
+    $script = Yaml::parse(generateDefaultProxyConfiguration($server->fresh()))['services']['traefik-logrotate']['entrypoint'][2];
+
+    expect(str_replace('$$', '', $script))->not->toContain('$')
+        ->and(str_replace('$$', '$', $script))->toBe(traefikAccessLogRotationScript());
 });
diff --git a/tests/Feature/TrafficAnalytics/TraefikUserAccessLogFlagsTest.php b/tests/Feature/TrafficAnalytics/TraefikUserAccessLogFlagsTest.php
new file mode 100644
index 0000000000..315538da1e
--- /dev/null
+++ b/tests/Feature/TrafficAnalytics/TraefikUserAccessLogFlagsTest.php
@@ -0,0 +1,201 @@
+<?php
+
+use App\Models\PrivateKey;
+use App\Models\Server;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Process;
+use Symfony\Component\Yaml\Yaml;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    Process::fake();
+
+    $user = User::factory()->create();
+    $team = $user->teams()->first();
+    $privateKey = PrivateKey::factory()->create(['team_id' => $team->id]);
+
+    $this->server = Server::factory()->create(['team_id' => $team->id, 'private_key_id' => $privateKey->id]);
+    $this->server->proxy->set('type', 'TRAEFIK');
+    $this->server->save();
+});
+
+/**
+ * Toggle analytics like ConfigureTrafficAnalytics does and run the given Traefik commands through the helper.
+ *
+ * @param  array<int, string>  $commands
+ * @return array<int, string>
+ */
+function applyTrafficAnalyticsToCommands(Server $server, bool $enabled, array $commands): array
+{
+    $server->settings->is_traffic_analytics_enabled = $enabled;
+    $server->settings->save();
+    $server->refresh();
+
+    $configuration = Yaml::dump(['services' => ['traefik' => ['command' => $commands]]], 12, 2);
+    $result = applyTrafficAnalyticsToProxyConfiguration($server, $configuration);
+
+    $server->refresh();
+
+    return Yaml::parse($result)['services']['traefik']['command'];
+}
+
+/**
+ * @param  array<int, string>  $commands
+ * @return array<int, string>
+ */
+function accessLogFlagsIn(array $commands): array
+{
+    return array_values(array_filter(
+        $commands,
+        fn (string $command): bool => $command === '--accesslog' || str_starts_with($command, '--accesslog=') || str_starts_with($command, '--accesslog.')
+    ));
+}
+
+it('restores a user --accesslog=true after enabling and disabling analytics', function () {
+    $userCommands = ['--providers.docker=true', '--accesslog=true'];
+
+    $enabled = applyTrafficAnalyticsToCommands($this->server, true, $userCommands);
+
+    expect(accessLogFlagsIn($enabled))->toBe(traefikAccessLogCommands(true))
+        ->and(array_count_values($enabled)['--accesslog=true'])->toBe(1);
+
+    $disabled = applyTrafficAnalyticsToCommands($this->server, false, $enabled);
+
+    expect($disabled)->toBe($userCommands)
+        ->and($this->server->proxy->get('traffic_analytics_user_accesslog_commands'))->toBeNull();
+});
+
+it('replaces a conflicting user access log format while enabled and restores it when disabled', function () {
+    $userCommands = ['--providers.docker=true', '--accesslog=true', '--accesslog.format=common'];
+
+    $enabled = applyTrafficAnalyticsToCommands($this->server, true, $userCommands);
+
+    expect($enabled)->not->toContain('--accesslog.format=common')
+        ->and(array_values(array_filter($enabled, fn (string $command): bool => str_starts_with($command, '--accesslog.format='))))
+        ->toBe(['--accesslog.format=json']);
+
+    $disabled = applyTrafficAnalyticsToCommands($this->server, false, $enabled);
+
+    expect($disabled)->toBe($userCommands);
+});
+
+it('remembers user access log filters while enabled and restores them exactly when disabled', function () {
+    $userCommands = [
+        '--providers.docker=true',
+        '--accesslog=true',
+        '--accesslog.filters.statuscodes=400-599',
+        '--accesslog.filters.minduration=10ms',
+        '--accesslog.bufferingsize=100',
+    ];
+
+    $enabled = applyTrafficAnalyticsToCommands($this->server, true, $userCommands);
+
+    expect(accessLogFlagsIn($enabled))->toBe(traefikAccessLogCommands(true))
+        ->and($this->server->proxy->get('traffic_analytics_user_accesslog_commands'))->toBe([
+            '--accesslog=true',
+            '--accesslog.filters.statuscodes=400-599',
+            '--accesslog.filters.minduration=10ms',
+            '--accesslog.bufferingsize=100',
+        ]);
+
+    $disabled = applyTrafficAnalyticsToCommands($this->server, false, $enabled);
+
+    expect($disabled)->toBe($userCommands);
+});
+
+it('is idempotent when analytics is enabled twice', function () {
+    $userCommands = ['--providers.docker=true', '--accesslog=true', '--accesslog.format=common'];
+
+    $first = applyTrafficAnalyticsToCommands($this->server, true, $userCommands);
+    $second = applyTrafficAnalyticsToCommands($this->server, true, $first);
+
+    expect($second)->toBe($first)
+        ->and($this->server->proxy->get('traffic_analytics_user_accesslog_commands'))->toBe(['--accesslog=true', '--accesslog.format=common']);
+
+    $disabled = applyTrafficAnalyticsToCommands($this->server, false, $second);
+
+    expect($disabled)->toBe($userCommands);
+});
+
+it('is idempotent when analytics is disabled twice', function () {
+    $userCommands = ['--providers.docker=true', '--accesslog=true'];
+
+    $enabled = applyTrafficAnalyticsToCommands($this->server, true, $userCommands);
+    $disabled = applyTrafficAnalyticsToCommands($this->server, false, $enabled);
+    $disabledAgain = applyTrafficAnalyticsToCommands($this->server, false, $disabled);
+
+    expect($disabledAgain)->toBe($userCommands);
+});
+
+it('keeps a user --accesslog=true when analytics was never enabled', function () {
+    $userCommands = ['--providers.docker=true', '--accesslog=true', '--accesslog.format=common'];
+
+    expect(applyTrafficAnalyticsToCommands($this->server, false, $userCommands))->toBe($userCommands);
+});
+
+it('removes only the managed flags when disabling analytics that was enabled before flags were remembered', function () {
+    $legacyEnabled = [
+        '--providers.docker=true',
+        '--accesslog.bufferingsize=100',
+        ...traefikAccessLogCommands(true),
+    ];
+
+    $disabled = applyTrafficAnalyticsToCommands($this->server, false, $legacyEnabled);
+
+    expect($disabled)->toBe(['--providers.docker=true', '--accesslog.bufferingsize=100']);
+});
+
+it('remembers only user flags when re-enabling analytics that was enabled before flags were remembered', function () {
+    $legacyEnabled = [
+        '--providers.docker=true',
+        '--accesslog.bufferingsize=100',
+        ...traefikAccessLogCommands(true),
+    ];
+
+    $enabled = applyTrafficAnalyticsToCommands($this->server, true, $legacyEnabled);
+
+    expect(accessLogFlagsIn($enabled))->toBe(traefikAccessLogCommands(true))
+        ->and($this->server->proxy->get('traffic_analytics_user_accesslog_commands'))->toBe(['--accesslog.bufferingsize=100']);
+
+    $disabled = applyTrafficAnalyticsToCommands($this->server, false, $enabled);
+
+    expect($disabled)->toBe(['--providers.docker=true', '--accesslog.bufferingsize=100']);
+});
+
+it('keeps a custom --accesslog=true when resetting to the default configuration with analytics off', function () {
+    $this->server->settings->is_traffic_analytics_enabled = false;
+    $this->server->settings->save();
+
+    $existing = Yaml::dump(['services' => ['traefik' => ['command' => [
+        '--providers.docker=true',
+        '--accesslog=true',
+        '--entrypoints.http.forwardedHeaders.trustedIPs=173.245.48.0/20',
+    ]]]], 12, 2);
+
+    $server = $this->server->fresh();
+    $customCommands = extractCustomProxyCommands($server, $existing);
+    $commands = Yaml::parse(generateDefaultProxyConfiguration($server, $customCommands))['services']['traefik']['command'];
+
+    expect($commands)->toContain('--accesslog=true')
+        ->toContain('--entrypoints.http.forwardedHeaders.trustedIPs=173.245.48.0/20')
+        ->not->toContain('--accesslog.format=json')
+        ->not->toContain('--accesslog.filepath=/traefik/access.log');
+});
+
+it('keeps the remembered user flags when resetting to the default configuration with analytics on', function () {
+    $userCommands = ['--providers.docker=true', '--accesslog=true', '--accesslog.format=common'];
+    $enabled = applyTrafficAnalyticsToCommands($this->server, true, $userCommands);
+
+    $server = $this->server->fresh();
+    $existing = Yaml::dump(['services' => ['traefik' => ['command' => $enabled]]], 12, 2);
+    $commands = Yaml::parse(generateDefaultProxyConfiguration($server, extractCustomProxyCommands($server, $existing)))['services']['traefik']['command'];
+
+    expect(accessLogFlagsIn($commands))->toBe(traefikAccessLogCommands(true))
+        ->and($server->fresh()->proxy->get('traffic_analytics_user_accesslog_commands'))->toBe(['--accesslog=true', '--accesslog.format=common']);
+
+    $disabled = applyTrafficAnalyticsToCommands($server, false, $commands);
+
+    expect(accessLogFlagsIn($disabled))->toBe(['--accesslog=true', '--accesslog.format=common']);
+});
diff --git a/tests/Feature/TrafficAnalytics/TrafficNudgeTest.php b/tests/Feature/TrafficAnalytics/TrafficNudgeTest.php
index eb2eb83de9..920e1ade34 100644
--- a/tests/Feature/TrafficAnalytics/TrafficNudgeTest.php
+++ b/tests/Feature/TrafficAnalytics/TrafficNudgeTest.php
@@ -1,5 +1,6 @@
 <?php
 
+use App\Enums\ServerRole;
 use App\Livewire\Analytics;
 use App\Livewire\Dashboard\TrafficAnalytics as DashboardTrafficAnalytics;
 use App\Models\PrivateKey;
@@ -55,6 +56,7 @@ it('does not count swarm or build servers in the analytics-page nudge', function
     $swarm->settings->save();
 
     $build = disabledServer();
+    $build->settings->server_role = ServerRole::BUILD;
     $build->settings->is_build_server = true;
     $build->settings->save();
 
diff --git a/tests/Feature/Webhook/WebhookHmacTest.php b/tests/Feature/Webhook/WebhookHmacTest.php
index 842fc00266..557569f31d 100644
--- a/tests/Feature/Webhook/WebhookHmacTest.php
+++ b/tests/Feature/Webhook/WebhookHmacTest.php
@@ -1,6 +1,8 @@
 <?php
 
+use App\Http\Controllers\Webhook\Concerns\MatchesManualWebhookApplications;
 use App\Models\Application;
+use App\Models\ApplicationDeploymentQueue;
 use App\Models\Environment;
 use App\Models\GithubApp;
 use App\Models\Project;
@@ -9,6 +11,7 @@ use App\Models\Team;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Queue;
 use Illuminate\Support\Facades\RateLimiter;
 use Illuminate\Support\Facades\Route;
 use Illuminate\Testing\TestResponse;
@@ -16,13 +19,19 @@ use Tests\TestCase;
 
 uses(RefreshDatabase::class);
 
+beforeEach(function () {
+    // Tests below change server settings; the static Server identity map must
+    // not carry a cached server (same id after rollback) into the next test.
+    Server::flushIdentityMap();
+});
+
 test('manual webhook routes are not rate limited per request', function (string $provider) {
     $route = Route::getRoutes()->match(Request::create("/webhooks/source/{$provider}/events/manual", 'POST'));
 
     expect(collect($route->gatherMiddleware())->filter(fn (mixed $middleware): bool => is_string($middleware) && str_starts_with($middleware, 'throttle')))->toBeEmpty();
 })->with(['github', 'gitlab', 'bitbucket', 'gitea']);
 
-function sendManualWebhookPush(TestCase $test, string $provider, Application $application, bool $validSignature = true, string $ip = '203.0.113.10', string $repository = 'test-org/test-repo'): TestResponse
+function sendManualWebhookPush(TestCase $test, string $provider, Application $application, bool $validSignature = true, string $ip = '203.0.113.10', string $repository = 'test-org/test-repo', string $branch = 'main'): TestResponse
 {
     $secret = $validSignature ? $application->{"manual_webhook_secret_{$provider}"} : 'wrong-secret';
     $server = ['REMOTE_ADDR' => $ip, 'CONTENT_TYPE' => 'application/json'];
@@ -30,7 +39,7 @@ function sendManualWebhookPush(TestCase $test, string $provider, Application $ap
     if ($provider === 'gitlab') {
         $payload = json_encode([
             'object_kind' => 'push',
-            'ref' => 'refs/heads/main',
+            'ref' => "refs/heads/{$branch}",
             'project' => ['path_with_namespace' => $repository],
             'after' => 'abc123',
             'commits' => [],
@@ -43,7 +52,7 @@ function sendManualWebhookPush(TestCase $test, string $provider, Application $ap
 
     if ($provider === 'bitbucket') {
         $payload = json_encode([
-            'push' => ['changes' => [['new' => ['name' => 'main', 'target' => ['hash' => 'abc123']]]]],
+            'push' => ['changes' => [['new' => ['name' => $branch, 'target' => ['hash' => 'abc123']]]]],
             'repository' => ['full_name' => $repository],
         ]);
 
@@ -54,7 +63,7 @@ function sendManualWebhookPush(TestCase $test, string $provider, Application $ap
     }
 
     $payload = json_encode([
-        'ref' => 'refs/heads/main',
+        'ref' => "refs/heads/{$branch}",
         'repository' => ['full_name' => $repository],
         'after' => 'abc123',
         'commits' => [],
@@ -67,6 +76,46 @@ function sendManualWebhookPush(TestCase $test, string $provider, Application $ap
     ], $payload);
 }
 
+function manualWebhookFailureKey(string $provider, string $ip = '203.0.113.10', string $repository = 'test-org/test-repo', ?string $branch = 'main'): string
+{
+    $helper = new class
+    {
+        use MatchesManualWebhookApplications;
+
+        public function key(Request $request, string $provider, string $repository, ?string $branch): string
+        {
+            return $this->manualWebhookFailureRateLimitKey($request, $provider, $this->manualWebhookRepositoryFullName($repository), $branch);
+        }
+    };
+
+    return $helper->key(Request::create('/', 'POST', server: ['REMOTE_ADDR' => $ip]), $provider, $repository, $branch);
+}
+
+function lockOutManualWebhookRepository(TestCase $test, string $provider, Application $application, string $repository = 'test-org/test-repo', string $branch = 'main'): void
+{
+    for ($i = 0; $i < 30; $i++) {
+        $response = sendManualWebhookPush($test, $provider, $application, validSignature: false, repository: $repository, branch: $branch);
+
+        $response->assertOk();
+        expect($response->getContent())->toContain('Invalid signature');
+    }
+
+    sendManualWebhookPush($test, $provider, $application, validSignature: false, repository: $repository, branch: $branch)
+        ->assertStatus(429)
+        ->assertHeader('Retry-After');
+}
+
+function makeWebhookApplicationServerFunctional(Application $application): Application
+{
+    $application->destination->server->settings->update([
+        'is_reachable' => true,
+        'is_usable' => true,
+        'force_disabled' => false,
+    ]);
+
+    return $application->refresh();
+}
+
 describe('Manual Webhook Failed Authentication Rate Limiting', function () {
     test('valid signed deliveries are never throttled', function (string $provider) {
         $application = createApplicationWithWebhook();
@@ -78,24 +127,91 @@ describe('Manual Webhook Failed Authentication Rate Limiting', function () {
             expect($response->getContent())->not->toContain('Invalid signature');
         }
 
-        expect(RateLimiter::attempts("manual-webhook-failures:{$provider}:203.0.113.10"))->toBe(0);
+        expect(RateLimiter::attempts(manualWebhookFailureKey($provider)))->toBe(0);
     })->with(['github', 'gitlab', 'bitbucket', 'gitea']);
 
     test('repeated invalid signatures are throttled after 30 failures', function (string $provider) {
         $application = createApplicationWithWebhook();
 
+        lockOutManualWebhookRepository($this, $provider, $application);
+
+        expect(RateLimiter::tooManyAttempts(manualWebhookFailureKey($provider), 30))->toBeTrue();
+    })->with(['github', 'gitlab', 'bitbucket', 'gitea']);
+
+    test('a locked out repository rejects every delivery for that repository and branch before verification', function (string $provider) {
+        Queue::fake();
+        $application = makeWebhookApplicationServerFunctional(createApplicationWithWebhook());
+
+        lockOutManualWebhookRepository($this, $provider, $application);
+
+        sendManualWebhookPush($this, $provider, $application, validSignature: false)->assertStatus(429);
+        // A correct guess during the lockout must not succeed, otherwise the
+        // lockout does not limit how fast a secret can be guessed.
+        sendManualWebhookPush($this, $provider, $application)->assertStatus(429);
+        sendManualWebhookPush($this, $provider, $application, validSignature: false, repository: 'TEST-ORG/Test-Repo.git')->assertStatus(429);
+
+        expect(ApplicationDeploymentQueue::query()->where('application_id', $application->id)->exists())->toBeFalse();
+    })->with(['github', 'gitlab', 'bitbucket', 'gitea']);
+
+    test('a wrong secret for one repository does not block a signed delivery for another repository from the same IP', function (string $provider) {
+        Queue::fake();
+        $misconfigured = createApplicationWithWebhook(repo: 'other-tenant/misconfigured-repo', overrides: ['name' => 'misconfigured-app']);
+        $application = makeWebhookApplicationServerFunctional(createApplicationWithWebhook());
+
+        lockOutManualWebhookRepository($this, $provider, $misconfigured, repository: 'other-tenant/misconfigured-repo');
+
+        $response = sendManualWebhookPush($this, $provider, $application);
+
+        $response->assertOk();
+        expect($response->getContent())->toContain('Deployment queued');
+        expect(ApplicationDeploymentQueue::query()->where('application_id', $application->id)->exists())->toBeTrue();
+
+        sendManualWebhookPush($this, $provider, $misconfigured, validSignature: false, repository: 'other-tenant/misconfigured-repo')->assertStatus(429);
+    })->with(['github', 'gitlab', 'bitbucket', 'gitea']);
+
+    test('deliveries for unknown repositories do not block signed deliveries for known repositories', function (string $provider) {
+        Queue::fake();
+        $application = makeWebhookApplicationServerFunctional(createApplicationWithWebhook());
+
+        for ($i = 0; $i < 40; $i++) {
+            $response = sendManualWebhookPush($this, $provider, $application, validSignature: false, repository: 'deleted-org/deleted-repo');
+
+            expect($response->getStatusCode())->toBeIn([200, 429]);
+        }
+
+        $response = sendManualWebhookPush($this, $provider, $application);
+
+        $response->assertOk();
+        expect($response->getContent())->toContain('Deployment queued');
+        expect(RateLimiter::attempts(manualWebhookFailureKey($provider)))->toBe(0);
+    })->with(['github', 'gitlab', 'bitbucket', 'gitea']);
+
+    test('pushes to untracked branches do not block the deployed branch', function (string $provider) {
+        Queue::fake();
+        $application = makeWebhookApplicationServerFunctional(createApplicationWithWebhook());
+
+        for ($i = 0; $i < 40; $i++) {
+            sendManualWebhookPush($this, $provider, $application, branch: 'feature/untracked');
+        }
+
+        $response = sendManualWebhookPush($this, $provider, $application);
+
+        $response->assertOk();
+        expect($response->getContent())->toContain('Deployment queued');
+    })->with(['github', 'gitlab', 'bitbucket', 'gitea']);
+
+    test('unknown repositories respond like invalid signatures and are still throttled', function () {
+        $application = createApplicationWithWebhook();
+
         for ($i = 0; $i < 30; $i++) {
-            $response = sendManualWebhookPush($this, $provider, $application, validSignature: false);
+            $response = sendManualWebhookPush($this, 'github', $application, repository: 'unknown-org/unknown-repo');
 
             $response->assertOk();
             expect($response->getContent())->toContain('Invalid signature');
         }
 
-        $response = sendManualWebhookPush($this, $provider, $application, validSignature: false);
-
-        $response->assertStatus(429);
-        $response->assertHeader('Retry-After');
-    })->with(['github', 'gitlab', 'bitbucket', 'gitea']);
+        sendManualWebhookPush($this, 'github', $application, repository: 'unknown-org/unknown-repo')->assertStatus(429);
+    });
 
     test('valid deliveries do not count when another matching application has a different secret', function () {
         $application = createApplicationWithWebhook();
@@ -108,31 +224,24 @@ describe('Manual Webhook Failed Authentication Rate Limiting', function () {
             expect($response->getContent())->not->toContain('Invalid signature');
         }
 
-        expect(RateLimiter::attempts('manual-webhook-failures:github:203.0.113.10'))->toBe(0);
+        expect(RateLimiter::attempts(manualWebhookFailureKey('github')))->toBe(0);
     });
 
-    test('deliveries for unknown repositories count as failed authentication', function () {
-        $application = createApplicationWithWebhook();
-
-        for ($i = 0; $i < 30; $i++) {
-            sendManualWebhookPush($this, 'github', $application, repository: 'unknown-org/unknown-repo')->assertOk();
-        }
-
-        sendManualWebhookPush($this, 'github', $application)->assertStatus(429);
-    });
-
-    test('gitlab deliveries without a token count as failed authentication', function () {
+    test('gitlab deliveries without a token are rejected and do not count as failed authentication', function () {
         createApplicationWithWebhook();
 
-        for ($i = 0; $i < 30; $i++) {
-            $this->postJson('/webhooks/source/gitlab/events/manual', [
+        for ($i = 0; $i < 40; $i++) {
+            $response = $this->postJson('/webhooks/source/gitlab/events/manual', [
                 'object_kind' => 'push',
                 'ref' => 'refs/heads/main',
                 'project' => ['path_with_namespace' => 'test-org/test-repo'],
-            ])->assertOk();
+            ]);
+
+            $response->assertOk();
+            expect($response->getContent())->toContain('Invalid signature');
         }
 
-        expect(RateLimiter::tooManyAttempts('manual-webhook-failures:gitlab:127.0.0.1', 30))->toBeTrue();
+        expect(RateLimiter::attempts(manualWebhookFailureKey('gitlab', '127.0.0.1')))->toBe(0);
     });
 
     test('ping deliveries do not count as failures', function () {
@@ -155,10 +264,7 @@ describe('Manual Webhook Failed Authentication Rate Limiting', function () {
     test('failures on one provider do not block another provider', function () {
         $application = createApplicationWithWebhook();
 
-        for ($i = 0; $i < 30; $i++) {
-            sendManualWebhookPush($this, 'github', $application, validSignature: false);
-        }
-        sendManualWebhookPush($this, 'github', $application, validSignature: false)->assertStatus(429);
+        lockOutManualWebhookRepository($this, 'github', $application);
 
         foreach (['gitlab', 'bitbucket', 'gitea'] as $provider) {
             $response = sendManualWebhookPush($this, $provider, $application);
diff --git a/tests/Fixtures/terminal-websocket-rejection-server.mjs b/tests/Fixtures/terminal-websocket-rejection-server.mjs
new file mode 100644
index 0000000000..f7fd59ab17
--- /dev/null
+++ b/tests/Fixtures/terminal-websocket-rejection-server.mjs
@@ -0,0 +1,68 @@
+// Minimal stand-in for the terminal WebSocket server used by browser tests.
+// Built on Node core only (no `ws`), it reproduces how the real server rejects
+// authentication so the browser client can be tested end to end.
+//
+// Usage: node terminal-websocket-rejection-server.mjs <mode>
+//   close-on-upgrade: complete the handshake, then close with 4401 (session rejected)
+//   reject-token:     on the first client frame, send the legacy text message and close with 4403
+//
+// Prints the listening port on stdout. GET /stats returns {"upgrades": n}.
+import { createHash } from 'node:crypto';
+import http from 'node:http';
+
+const mode = process.argv[2] ?? 'close-on-upgrade';
+let upgrades = 0;
+
+function frame(opcode, payload) {
+    if (payload.length > 125) {
+        throw new Error('Fixture only supports short frames.');
+    }
+
+    return Buffer.concat([Buffer.from([0x80 | opcode, payload.length]), payload]);
+}
+
+function closeFrame(code, reason) {
+    const payload = Buffer.alloc(2 + Buffer.byteLength(reason));
+    payload.writeUInt16BE(code, 0);
+    payload.write(reason, 2);
+
+    return frame(0x8, payload);
+}
+
+const server = http.createServer((req, res) => {
+    res.writeHead(200, { 'Content-Type': 'application/json', 'Access-Control-Allow-Origin': '*' });
+    res.end(JSON.stringify({ upgrades }));
+});
+
+server.on('upgrade', (req, socket) => {
+    upgrades++;
+    socket.on('error', () => socket.destroy());
+
+    const accept = createHash('sha1')
+        .update(`${req.headers['sec-websocket-key']}258EAFA5-E914-47DA-95CA-C5AB0DC85B11`)
+        .digest('base64');
+
+    socket.write([
+        'HTTP/1.1 101 Switching Protocols',
+        'Upgrade: websocket',
+        'Connection: Upgrade',
+        `Sec-WebSocket-Accept: ${accept}`,
+        '',
+        '',
+    ].join('\r\n'));
+
+    if (mode === 'close-on-upgrade') {
+        socket.end(closeFrame(4401, 'Unauthorized: Invalid credentials'));
+        return;
+    }
+
+    socket.once('data', () => {
+        const message = 'Unauthorized: Terminal token was rejected';
+        socket.write(frame(0x1, Buffer.from(message)));
+        socket.end(closeFrame(4403, message));
+    });
+});
+
+server.listen(0, '127.0.0.1', () => {
+    process.stdout.write(`${server.address().port}\n`);
+});
diff --git a/tests/Unit/DatabaseImport/DatabaseImportRestoreScriptTest.php b/tests/Unit/DatabaseImport/DatabaseImportRestoreScriptTest.php
index 15ce9c2222..0d722bce15 100644
--- a/tests/Unit/DatabaseImport/DatabaseImportRestoreScriptTest.php
+++ b/tests/Unit/DatabaseImport/DatabaseImportRestoreScriptTest.php
@@ -285,26 +285,31 @@ test('restores single PostgreSQL archives with pg_restore and SQL with psql', fu
     expect($run['exit'])->toBe(0, $run['stderr']);
     restoreScriptExpectCalls($run['calls'], $expectedCalls);
 })->with([
-    'custom archive' => ['pg-custom', false, [['pg_restore', 'PGDMP', ['--exit-on-error -U postgres -d app']]]],
-    'custom archive replacing existing objects' => ['pg-custom', true, [['pg_restore', 'PGDMP', ['--exit-on-error --clean --if-exists -U postgres -d app']]]],
-    'gzip custom archive' => ['pg-custom-gz', false, [['pg_restore', 'PGDMP', ['--exit-on-error -U postgres -d app']]]],
-    'gzip custom archive replacing existing objects' => ['pg-custom-gz', true, [['pg_restore', 'PGDMP', ['--exit-on-error --clean --if-exists -U postgres -d app']]]],
-    'tar archive' => ['pg-tar', false, [['pg_restore', 'toc.d', ['--exit-on-error -U postgres -d app']]]],
-    'gzip tar archive' => ['pg-tar-gz', false, [['pg_restore', 'toc.d', ['--exit-on-error -U postgres -d app']]]],
-    'plain SQL' => ['pg-sql', false, [['psql', '-- Po', ['-v ON_ERROR_STOP=1 -U postgres -d app']]]],
-    'gzip SQL' => ['pg-sql-gz', false, [['psql', '-- Po', ['-v ON_ERROR_STOP=1 -U postgres -d app']]]],
-    // SQL cannot replace single objects, so replacing recreates the target database first.
+    'custom archive' => ['pg-custom', false, [['pg_restore', 'PGDMP', ['--exit-on-error --single-transaction -U postgres -d app']]]],
+    'custom archive replacing existing objects' => ['pg-custom', true, [['pg_restore', 'PGDMP', ['--exit-on-error --single-transaction --clean --if-exists -U postgres -d app']]]],
+    'gzip custom archive' => ['pg-custom-gz', false, [['pg_restore', 'PGDMP', ['--exit-on-error --single-transaction -U postgres -d app']]]],
+    'gzip custom archive replacing existing objects' => ['pg-custom-gz', true, [['pg_restore', 'PGDMP', ['--exit-on-error --single-transaction --clean --if-exists -U postgres -d app']]]],
+    'tar archive' => ['pg-tar', false, [['pg_restore', 'toc.d', ['--exit-on-error --single-transaction -U postgres -d app']]]],
+    'gzip tar archive' => ['pg-tar-gz', false, [['pg_restore', 'toc.d', ['--exit-on-error --single-transaction -U postgres -d app']]]],
+    'plain SQL' => ['pg-sql', false, [['psql', '-- Po', ['-v ON_ERROR_STOP=1 --single-transaction -U postgres -d app']]]],
+    'gzip SQL' => ['pg-sql-gz', false, [['psql', '-- Po', ['-v ON_ERROR_STOP=1 --single-transaction -U postgres -d app']]]],
+    // SQL cannot replace single objects: it restores into a new database, and only a
+    // successful restore replaces the current one, so a failure changes nothing.
     'plain SQL replacing existing objects' => ['pg-sql', true, [
-        ['psql', 'SELEC', ['-v db=app -U postgres -d template1']],
-        ['dropdb', '', ['--maintenance-db=template1 -U postgres --if-exists app']],
-        ['createdb', '', ['-U postgres app']],
-        ['psql', '-- Po', ['-v ON_ERROR_STOP=1 -U postgres -d app']],
+        ['dropdb', '', ['--maintenance-db=template1 -U postgres --if-exists coolify_restore_new']],
+        ['createdb', '', ['-U postgres coolify_restore_new']],
+        ['psql', '-- Po', ['-v ON_ERROR_STOP=1 --single-transaction -U postgres -d coolify_restore_new']],
+        ['dropdb', '', ['--maintenance-db=template1 -U postgres --if-exists coolify_restore_old']],
+        ['psql', 'SELEC', ['-v ON_ERROR_STOP=1 -v db=app -v old=coolify_restore_old -v new=coolify_restore_new -U postgres -d template1']],
+        ['dropdb', '', ['--maintenance-db=template1 -U postgres --if-exists coolify_restore_old']],
     ]],
     'gzip SQL replacing existing objects' => ['pg-sql-gz', true, [
-        ['psql', 'SELEC', ['-v db=app -U postgres -d template1']],
-        ['dropdb', '', ['--maintenance-db=template1 -U postgres --if-exists app']],
-        ['createdb', '', ['-U postgres app']],
-        ['psql', '-- Po', ['-v ON_ERROR_STOP=1 -U postgres -d app']],
+        ['dropdb', '', ['--maintenance-db=template1 -U postgres --if-exists coolify_restore_new']],
+        ['createdb', '', ['-U postgres coolify_restore_new']],
+        ['psql', '-- Po', ['-v ON_ERROR_STOP=1 --single-transaction -U postgres -d coolify_restore_new']],
+        ['dropdb', '', ['--maintenance-db=template1 -U postgres --if-exists coolify_restore_old']],
+        ['psql', 'SELEC', ['-v ON_ERROR_STOP=1 -v db=app -v old=coolify_restore_old -v new=coolify_restore_new -U postgres -d template1']],
+        ['dropdb', '', ['--maintenance-db=template1 -U postgres --if-exists coolify_restore_old']],
     ]],
 ]);
 
diff --git a/tests/v4/Browser/TerminalAutoStartFailureTest.php b/tests/v4/Browser/TerminalAutoStartFailureTest.php
new file mode 100644
index 0000000000..013b7d5ed6
--- /dev/null
+++ b/tests/v4/Browser/TerminalAutoStartFailureTest.php
@@ -0,0 +1,60 @@
+<?php
+
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\Process;
+use Symfony\Component\Process\Process as SymfonyProcess;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    config()->set('app.maintenance.store', 'array');
+    config()->set('constants.ssh.mux_enabled', false);
+
+    $stack = seedBrowserResourceStack();
+    $stack['server']->settings->update(['is_terminal_enabled' => true]);
+    $this->application = createBrowserApplication($stack, ['uuid' => 'app-terminal-autostart']);
+    $this->terminalPath = "/project/{$stack['project']->uuid}/environment/{$stack['environment']->uuid}/application/{$this->application->uuid}/terminal";
+    Cache::flush();
+
+    // An open WebSocket that accepts the connection and waits (it only reacts to a client frame).
+    $this->terminalServer = new SymfonyProcess(['node', base_path('tests/Fixtures/terminal-websocket-rejection-server.mjs'), 'reject-token']);
+    $this->terminalServer->start();
+    $this->terminalServer->waitUntil(fn (string $type, string $output) => str_contains($output, "\n"));
+    config()->set('constants.terminal.protocol', 'ws');
+    config()->set('constants.terminal.host', '127.0.0.1');
+    config()->set('constants.terminal.port', trim($this->terminalServer->getOutput()));
+});
+
+afterEach(function () {
+    $this->terminalServer?->stop(0);
+});
+
+it('shows why an auto-started container terminal cannot start instead of connecting forever', function () {
+    // One running container makes the page auto-connect; it stops before the token is issued.
+    Process::fake(function ($process) {
+        $command = (string) $process->command;
+
+        if (str_contains($command, 'docker ps -a')) {
+            return Process::result(output: json_encode(['Names' => 'app-terminal-autostart-1', 'State' => 'running', 'Labels' => '']));
+        }
+
+        if (str_contains($command, 'docker inspect')) {
+            return Process::result(output: json_encode(['State' => ['Status' => 'exited']]));
+        }
+
+        return Process::result();
+    });
+
+    $page = visit('/login')
+        ->fill('email', 'test@example.com')
+        ->fill('password', 'password')
+        ->click('Login')
+        ->assertSee('Dashboard')
+        ->navigate($this->terminalPath)
+        ->assertSee('The container is not running.')
+        ->assertSee('Reload page')
+        ->assertDontSee('connecting…');
+
+    $page->screenshot(filename: 'terminal-auto-start-container-not-running');
+});
diff --git a/tests/v4/Browser/TerminalConnectionFailureTest.php b/tests/v4/Browser/TerminalConnectionFailureTest.php
new file mode 100644
index 0000000000..f4d391f6f9
--- /dev/null
+++ b/tests/v4/Browser/TerminalConnectionFailureTest.php
@@ -0,0 +1,108 @@
+<?php
+
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Cache;
+use Symfony\Component\Process\Process;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    config()->set('app.maintenance.store', 'array');
+
+    $stack = seedBrowserResourceStack();
+    $stack['server']->settings->update(['is_terminal_enabled' => true]);
+    $this->serverUuid = $stack['server']->uuid;
+    Cache::flush();
+
+    $this->terminalServer = null;
+});
+
+afterEach(function () {
+    $this->terminalServer?->stop(0);
+});
+
+/**
+ * Start the fake terminal WebSocket server and point the terminal client at it.
+ */
+function startFakeTerminalServer(string $mode): array
+{
+    $process = new Process(['node', base_path('tests/Fixtures/terminal-websocket-rejection-server.mjs'), $mode]);
+    $process->start();
+    $process->waitUntil(fn (string $type, string $output) => str_contains($output, "\n"));
+    $port = (int) trim($process->getOutput());
+
+    config()->set('constants.terminal.protocol', 'ws');
+    config()->set('constants.terminal.host', '127.0.0.1');
+    config()->set('constants.terminal.port', (string) $port);
+
+    return [$process, $port];
+}
+
+function fakeTerminalServerUpgrades(int $port): int
+{
+    return json_decode(file_get_contents("http://127.0.0.1:{$port}/stats"), true)['upgrades'];
+}
+
+/**
+ * The browser plugin only boots for tests whose closure calls `visit(` as a standalone expression.
+ */
+function openServerTerminal(mixed $loginPage, string $serverUuid): mixed
+{
+    return $loginPage
+        ->fill('email', 'test@example.com')
+        ->fill('password', 'password')
+        ->click('Login')
+        ->assertSee('Dashboard')
+        ->navigate("/server/{$serverUuid}/terminal");
+}
+
+it('shows an auth rejection instead of connecting forever and does not reconnect', function () {
+    [$this->terminalServer, $port] = startFakeTerminalServer('close-on-upgrade');
+
+    $loginPage = visit('/login');
+
+    $page = openServerTerminal($loginPage, $this->serverUuid)
+        ->assertSee('Terminal access was rejected. Reload the page and try again.')
+        ->assertSee('Reload page')
+        ->assertDontSee('connecting…');
+
+    // Auth rejections must not start the exponential reconnect loop.
+    $page->wait(4);
+    expect(fakeTerminalServerUpgrades($port))->toBe(1);
+
+    $page->assertSee('Terminal access was rejected. Reload the page and try again.')
+        ->screenshot(filename: 'terminal-auth-rejected');
+});
+
+it('shows an auth rejection when the terminal token is rejected', function () {
+    [$this->terminalServer, $port] = startFakeTerminalServer('reject-token');
+
+    $loginPage = visit('/login');
+
+    $page = openServerTerminal($loginPage, $this->serverUuid)
+        ->assertSee('Terminal access was rejected. Reload the page and try again.')
+        ->assertDontSee('connecting…');
+
+    $page->wait(4);
+    expect(fakeTerminalServerUpgrades($port))->toBe(1);
+
+    $page->screenshot(filename: 'terminal-token-rejected');
+});
+
+it('shows a connection error when the terminal server is unreachable', function () {
+    // Reserve a free port, then release it so nothing is listening there.
+    $socket = stream_socket_server('tcp://127.0.0.1:0');
+    $port = (int) substr(strrchr(stream_socket_get_name($socket, false), ':'), 1);
+    fclose($socket);
+
+    config()->set('constants.terminal.protocol', 'ws');
+    config()->set('constants.terminal.host', '127.0.0.1');
+    config()->set('constants.terminal.port', (string) $port);
+
+    $loginPage = visit('/login');
+
+    openServerTerminal($loginPage, $this->serverUuid)
+        ->assertSee('Could not connect to the terminal server. Reload the page and try again.')
+        ->assertDontSee('connecting…')
+        ->screenshot(filename: 'terminal-connection-failed');
+});