diff --git a/app/Actions/Application/StopApplication.php b/app/Actions/Application/StopApplication.php
index b79709c5a..bfad20ccf 100644
--- a/app/Actions/Application/StopApplication.php
+++ b/app/Actions/Application/StopApplication.php
@@ -13,7 +13,7 @@ class StopApplication
 
     public string $jobQueue = 'high';
 
-    public function handle(Application $application, bool $previewDeployments = false, bool $dockerCleanup = true)
+    public function handle(Application $application, bool $previewDeployments = false, bool $dockerCleanup = true, bool $resetRestartCount = true)
     {
         $servers = collect([$application->destination->server]);
         if ($application?->additional_servers?->count() > 0) {
@@ -57,12 +57,17 @@ public function handle(Application $application, bool $previewDeployments = fals
             }
         }
 
-        // Reset restart tracking when application is manually stopped
-        $application->update([
-            'restart_count' => 0,
-            'last_restart_at' => null,
-            'last_restart_type' => null,
-        ]);
+        if ($resetRestartCount) {
+            $application->update([
+                'restart_count' => 0,
+                'last_restart_at' => null,
+                'last_restart_type' => null,
+            ]);
+        } else {
+            $application->update([
+                'status' => 'exited',
+            ]);
+        }
 
         ServiceStatusChanged::dispatch($application->environment->project->team->id);
     }
diff --git a/app/Actions/Docker/GetContainersStatus.php b/app/Actions/Docker/GetContainersStatus.php
index 5966876c6..904885dfc 100644
--- a/app/Actions/Docker/GetContainersStatus.php
+++ b/app/Actions/Docker/GetContainersStatus.php
@@ -2,6 +2,7 @@
 
 namespace App\Actions\Docker;
 
+use App\Actions\Application\StopApplication;
 use App\Actions\Database\StartDatabaseProxy;
 use App\Actions\Database\StopDatabaseProxy;
 use App\Actions\Shared\ComplexStatusCheck;
@@ -9,6 +10,7 @@
 use App\Models\ApplicationPreview;
 use App\Models\Server;
 use App\Models\ServiceDatabase;
+use App\Notifications\Application\RestartLimitReached as ApplicationRestartLimitReached;
 use App\Services\ContainerStatusAggregator;
 use App\Traits\CalculatesExcludedStatus;
 use Illuminate\Support\Arr;
@@ -464,7 +466,9 @@ public function handle(Server $server, ?Collection $containers = null, ?Collecti
                 }
 
                 // Wrap all database updates in a transaction to ensure consistency
-                DB::transaction(function () use ($application, $maxRestartCount, $containerStatuses) {
+                $restartLimitReached = false;
+
+                DB::transaction(function () use ($application, $maxRestartCount, $containerStatuses, &$restartLimitReached) {
                     $previousRestartCount = $application->restart_count ?? 0;
 
                     if ($maxRestartCount > $previousRestartCount) {
@@ -475,16 +479,10 @@ public function handle(Server $server, ?Collection $containers = null, ?Collecti
                             'last_restart_type' => 'crash',
                         ]);
 
-                        // Send notification
-                        $containerName = $application->name;
-                        $projectUuid = data_get($application, 'environment.project.uuid');
-                        $environmentName = data_get($application, 'environment.name');
-                        $applicationUuid = data_get($application, 'uuid');
-
-                        if ($projectUuid && $applicationUuid && $environmentName) {
-                            $url = base_url().'/project/'.$projectUuid.'/'.$environmentName.'/application/'.$applicationUuid;
-                        } else {
-                            $url = null;
+                        // Check if restart limit has been reached
+                        $maxAllowedRestarts = $application->max_restart_count ?? 0;
+                        if ($maxAllowedRestarts > 0 && $maxRestartCount >= $maxAllowedRestarts && $previousRestartCount < $maxAllowedRestarts) {
+                            $restartLimitReached = true;
                         }
                     }
 
@@ -499,6 +497,12 @@ public function handle(Server $server, ?Collection $containers = null, ?Collecti
                         }
                     }
                 });
+
+                if ($restartLimitReached) {
+                    $application->refresh();
+                    StopApplication::dispatch($application, false, true, false);
+                    $application->environment->project->team?->notify(new ApplicationRestartLimitReached($application));
+                }
             }
         }
 
diff --git a/app/Actions/Server/CleanupDocker.php b/app/Actions/Server/CleanupDocker.php
index 33558c746..06abeb3a6 100644
--- a/app/Actions/Server/CleanupDocker.php
+++ b/app/Actions/Server/CleanupDocker.php
@@ -51,7 +51,7 @@ public function handle(Server $server, bool $deleteUnusedVolumes = false, bool $
             'docker container prune -f --filter "label=coolify.managed=true" --filter "label!=coolify.proxy=true" --filter "label!=coolify.type=database" --filter "label!=coolify.type=application" --filter "label!=coolify.type=service"',
             $imagePruneCmd,
             'docker builder prune -af',
-            'docker buildx prune --builder coolify-railpack -af 2>/dev/null || true',
+            "docker run --rm -v \$HOME/.docker/buildx:/root/.docker/buildx -v /var/run/docker.sock:/var/run/docker.sock {$helperImageWithVersion} docker buildx prune --builder coolify-railpack -af 2>/dev/null || true",
             "docker images --filter before=$helperImageWithVersion --filter reference=$helperImage | grep $helperImage | awk '{print $3}' | xargs -r docker rmi -f",
             "docker images --filter before=$realtimeImageWithVersion --filter reference=$realtimeImage | grep $realtimeImage | awk '{print $3}' | xargs -r docker rmi -f",
             "docker images --filter before=$helperImageWithoutPrefixVersion --filter reference=$helperImageWithoutPrefix | grep $helperImageWithoutPrefix | awk '{print $3}' | xargs -r docker rmi -f",
diff --git a/app/Actions/Server/StartLogDrain.php b/app/Actions/Server/StartLogDrain.php
index e4df5a061..eb419992d 100644
--- a/app/Actions/Server/StartLogDrain.php
+++ b/app/Actions/Server/StartLogDrain.php
@@ -3,6 +3,7 @@
 namespace App\Actions\Server;
 
 use App\Models\Server;
+use App\Models\Service;
 use Lorisleiva\Actions\Concerns\AsAction;
 
 class StartLogDrain
@@ -201,10 +202,29 @@ public function handle(Server $server)
                 "echo 'Starting Fluent Bit'",
                 "cd $config_path && docker compose up -d",
             ];
+            $command = array_merge($command, $this->logDrainNetworkConnectCommands($server));
 
             return instant_remote_process($command, $server);
         } catch (\Throwable $e) {
             return handleError($e);
         }
     }
+
+    private function logDrainNetworkConnectCommands(Server $server): array
+    {
+        if (! $server->isLogDrainEnabled()) {
+            return [];
+        }
+
+        return $server->services()
+            ->with('destination')
+            ->where('connect_to_docker_network', true)
+            ->get()
+            ->map(fn (Service $service) => data_get($service, 'destination.network'))
+            ->filter()
+            ->unique()
+            ->map(fn (string $network) => 'docker network connect '.escapeshellarg($network).' coolify-log-drain >/dev/null 2>&1 || true')
+            ->values()
+            ->all();
+    }
 }
diff --git a/app/Actions/Service/StartService.php b/app/Actions/Service/StartService.php
index 89817506d..463a8ad5b 100644
--- a/app/Actions/Service/StartService.php
+++ b/app/Actions/Service/StartService.php
@@ -50,10 +50,32 @@ public function handle(Service $service, bool $pullLatestImages = false, bool $s
                 $commands[] = "docker network connect --alias {$serviceName}-{$service->uuid} {$safeNetwork} {$serviceName}-{$service->uuid} >/dev/null 2>&1 || true";
             }
         }
+        $commands = array_merge($commands, $this->logDrainNetworkConnectCommands($service));
 
         return remote_process($commands, $service->server, type_uuid: $service->uuid, callEventOnFinish: 'ServiceStatusChanged');
     }
 
+    private function logDrainNetworkConnectCommands(Service $service): array
+    {
+        if (! data_get($service, 'connect_to_docker_network')) {
+            return [];
+        }
+
+        if (! $service->destination?->server?->isLogDrainEnabled()) {
+            return [];
+        }
+
+        $network = data_get($service, 'destination.network');
+
+        if (blank($network)) {
+            return [];
+        }
+
+        return [
+            'docker network connect '.escapeshellarg($network).' coolify-log-drain >/dev/null 2>&1 || true',
+        ];
+    }
+
     private function shouldStopBeforeStarting(bool $pullLatestImages, bool $stopBeforeStart): bool
     {
         return $stopBeforeStart && ! $pullLatestImages;
diff --git a/app/Casts/EncryptedArrayCast.php b/app/Casts/EncryptedArrayCast.php
new file mode 100644
index 000000000..4f72c6286
--- /dev/null
+++ b/app/Casts/EncryptedArrayCast.php
@@ -0,0 +1,51 @@
+<?php
+
+namespace App\Casts;
+
+use Illuminate\Contracts\Database\Eloquent\CastsAttributes;
+use Illuminate\Contracts\Encryption\DecryptException;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Support\Facades\Crypt;
+
+/**
+ * Stores an array as an encrypted JSON string at rest. Tolerates legacy
+ * plaintext JSON rows written before the column was encrypted, so existing
+ * snapshots keep decoding instead of throwing.
+ *
+ * @implements CastsAttributes<array<mixed>|null, array<mixed>|null>
+ */
+class EncryptedArrayCast implements CastsAttributes
+{
+    /**
+     * @param  array<string, mixed>  $attributes
+     * @return array<mixed>|null
+     */
+    public function get(Model $model, string $key, mixed $value, array $attributes): ?array
+    {
+        if ($value === null || $value === '') {
+            return null;
+        }
+
+        try {
+            $value = Crypt::decryptString($value);
+        } catch (DecryptException) {
+            // Legacy plaintext JSON written before this column was encrypted.
+        }
+
+        $decoded = json_decode((string) $value, true);
+
+        return is_array($decoded) ? $decoded : null;
+    }
+
+    /**
+     * @param  array<string, mixed>  $attributes
+     */
+    public function set(Model $model, string $key, mixed $value, array $attributes): ?string
+    {
+        if ($value === null) {
+            return null;
+        }
+
+        return Crypt::encryptString(json_encode($value, JSON_THROW_ON_ERROR));
+    }
+}
diff --git a/app/Console/Commands/Init.php b/app/Console/Commands/Init.php
index e95c29f72..4783df072 100644
--- a/app/Console/Commands/Init.php
+++ b/app/Console/Commands/Init.php
@@ -253,7 +253,7 @@ private function restoreCoolifyDbBackup()
                             'save_s3' => false,
                             'frequency' => '0 0 * * *',
                             'database_id' => $database->id,
-                            'database_type' => \App\Models\StandalonePostgresql::class,
+                            'database_type' => StandalonePostgresql::class,
                             'team_id' => 0,
                         ]);
                     }
diff --git a/app/Console/Commands/SyncBunny.php b/app/Console/Commands/SyncBunny.php
index d6d77f22e..3f3e213fd 100644
--- a/app/Console/Commands/SyncBunny.php
+++ b/app/Console/Commands/SyncBunny.php
@@ -44,6 +44,7 @@ public function handle()
         $compose_file_prod = 'docker-compose.prod.yml';
         $install_script = 'install.sh';
         $upgrade_script = 'upgrade.sh';
+        $upgrade_postgres_script = 'upgrade-postgres.sh';
         $production_env = '.env.production';
         $service_template = config('constants.services.file_name');
         $versions = 'versions.json';
@@ -52,6 +53,7 @@ public function handle()
         $compose_file_prod_location = "$parent_dir/$compose_file_prod";
         $install_script_location = "$parent_dir/scripts/install.sh";
         $upgrade_script_location = "$parent_dir/scripts/upgrade.sh";
+        $upgrade_postgres_script_location = "$parent_dir/scripts/upgrade-postgres.sh";
         $production_env_location = "$parent_dir/.env.production";
         $versions_location = "$parent_dir/$versions";
 
@@ -87,6 +89,7 @@ public function handle()
                 $compose_file_prod_location = "$parent_dir/other/nightly/$compose_file_prod";
                 $production_env_location = "$parent_dir/other/nightly/$production_env";
                 $upgrade_script_location = "$parent_dir/other/nightly/$upgrade_script";
+                $upgrade_postgres_script_location = "$parent_dir/other/nightly/$upgrade_postgres_script";
                 $install_script_location = "$parent_dir/other/nightly/$install_script";
                 $versions_location = "$parent_dir/other/nightly/$versions";
             }
@@ -101,6 +104,7 @@ public function handle()
                     $compose_file_prod_location => "$bunny_cdn/$bunny_cdn_path/$compose_file_prod",
                     $production_env_location => "$bunny_cdn/$bunny_cdn_path/$production_env",
                     $upgrade_script_location => "$bunny_cdn/$bunny_cdn_path/$upgrade_script",
+                    $upgrade_postgres_script_location => "$bunny_cdn/$bunny_cdn_path/$upgrade_postgres_script",
                     $install_script_location => "$bunny_cdn/$bunny_cdn_path/$install_script",
                 ];
 
@@ -215,6 +219,7 @@ public function handle()
                 $pool->storage(fileName: "$compose_file_prod_location")->put("/$bunny_cdn_storage_name/$bunny_cdn_path/$compose_file_prod"),
                 $pool->storage(fileName: "$production_env_location")->put("/$bunny_cdn_storage_name/$bunny_cdn_path/$production_env"),
                 $pool->storage(fileName: "$upgrade_script_location")->put("/$bunny_cdn_storage_name/$bunny_cdn_path/$upgrade_script"),
+                $pool->storage(fileName: "$upgrade_postgres_script_location")->put("/$bunny_cdn_storage_name/$bunny_cdn_path/$upgrade_postgres_script"),
                 $pool->storage(fileName: "$install_script_location")->put("/$bunny_cdn_storage_name/$bunny_cdn_path/$install_script"),
             ]);
             Http::pool(fn (Pool $pool) => [
@@ -222,6 +227,7 @@ public function handle()
                 $pool->purge("$bunny_cdn/$bunny_cdn_path/$compose_file_prod"),
                 $pool->purge("$bunny_cdn/$bunny_cdn_path/$production_env"),
                 $pool->purge("$bunny_cdn/$bunny_cdn_path/$upgrade_script"),
+                $pool->purge("$bunny_cdn/$bunny_cdn_path/$upgrade_postgres_script"),
                 $pool->purge("$bunny_cdn/$bunny_cdn_path/$install_script"),
             ]);
             $this->info('All files uploaded & purged to BunnyCDN.');
diff --git a/app/Console/Kernel.php b/app/Console/Kernel.php
index e97105836..e6dc32383 100644
--- a/app/Console/Kernel.php
+++ b/app/Console/Kernel.php
@@ -8,6 +8,7 @@
 use App\Jobs\CheckTraefikVersionJob;
 use App\Jobs\CleanupInstanceStuffsJob;
 use App\Jobs\CleanupOrphanedPreviewContainersJob;
+use App\Jobs\CleanupStaleMultiplexedConnections;
 use App\Jobs\PullChangelog;
 use App\Jobs\PullTemplatesFromCDN;
 use App\Jobs\RegenerateSslCertJob;
@@ -40,6 +41,10 @@ protected function schedule(Schedule $schedule): void
             $this->instanceTimezone = config('app.timezone');
         }
 
+        $this->scheduleInstance->call(fn () => app(CleanupStaleMultiplexedConnections::class)->handle())
+            ->name('cleanup:ssh-mux')
+            ->hourly()
+            ->when(fn () => config('constants.ssh.mux_enabled') && ! config('constants.coolify.is_windows_docker_desktop'));
         $this->scheduleInstance->command('cleanup:redis --clear-locks')->daily();
         $this->scheduleInstance->command('sanctum:prune-expired --hours=1')->hourly()->onOneServer();
         $this->scheduleInstance->job(new ApiTokenExpirationWarningJob)->hourly()->onOneServer();
diff --git a/app/Helpers/SshMultiplexingHelper.php b/app/Helpers/SshMultiplexingHelper.php
index d0bd8d3a3..907cb4456 100644
--- a/app/Helpers/SshMultiplexingHelper.php
+++ b/app/Helpers/SshMultiplexingHelper.php
@@ -4,6 +4,8 @@
 
 use App\Models\PrivateKey;
 use App\Models\Server;
+use Illuminate\Contracts\Cache\LockTimeoutException;
+use Illuminate\Support\Facades\Cache;
 use Illuminate\Support\Facades\Hash;
 use Illuminate\Support\Facades\Log;
 use Illuminate\Support\Facades\Process;
@@ -23,23 +25,77 @@ public static function serverSshConfiguration(Server $server): array
 
     public static function ensureMultiplexedConnection(Server $server): bool
     {
-        return self::isMultiplexingEnabled();
+        if (! self::isMultiplexingEnabled()) {
+            return false;
+        }
+
+        if (self::connectionIsReusable($server)) {
+            return true;
+        }
+
+        try {
+            return Cache::lock(
+                self::connectionLockKey($server),
+                config('constants.ssh.mux_lock_ttl')
+            )->block(config('constants.ssh.mux_lock_timeout'), function () use ($server) {
+                if (self::connectionIsReusable($server)) {
+                    return true;
+                }
+
+                if (self::masterConnectionExists($server)) {
+                    return self::refreshMultiplexedConnection($server);
+                }
+
+                return self::establishNewMultiplexedConnection($server);
+            });
+        } catch (LockTimeoutException) {
+            Log::warning('SSH multiplexing lock timeout, falling back to non-multiplexed connection', [
+                'server' => $server->name ?? $server->ip,
+            ]);
+
+            return false;
+        } catch (\Throwable $e) {
+            Log::warning('SSH multiplexing lock unavailable, falling back to non-multiplexed connection', [
+                'server' => $server->name ?? $server->ip,
+                'error' => $e->getMessage(),
+            ]);
+
+            return false;
+        }
+    }
+
+    public static function establishNewMultiplexedConnection(Server $server): bool
+    {
+        $sshConfig = self::serverSshConfiguration($server);
+        $sshKeyLocation = $sshConfig['sshKeyLocation'];
+        $muxSocket = $sshConfig['muxFilename'];
+        $connectionTimeout = self::getConnectionTimeout($server);
+        $serverInterval = config('constants.ssh.server_interval');
+        $muxPersistTime = config('constants.ssh.mux_persist_time');
+
+        $establishCommand = "ssh -fN -o ControlMaster=auto -o ControlPath=$muxSocket -o ControlPersist={$muxPersistTime} ";
+
+        if (data_get($server, 'settings.is_cloudflare_tunnel')) {
+            $establishCommand .= ' -o ProxyCommand="cloudflared access ssh --hostname %h" ';
+        }
+
+        $establishCommand .= self::getCommonSshOptions($server, $sshKeyLocation, $connectionTimeout, $serverInterval);
+        $establishCommand .= self::escapedUserAtHost($server);
+
+        $establishProcess = Process::run($establishCommand);
+        if ($establishProcess->exitCode() !== 0) {
+            return false;
+        }
+
+        self::storeConnectionMetadata($server);
+
+        return true;
     }
 
     public static function removeMuxFile(Server $server): void
     {
-        $closeCommand = self::muxControlCommand($server, 'exit');
-        Process::run($closeCommand);
-    }
-
-    private static function muxControlCommand(Server $server, string $operation): string
-    {
-        $command = "ssh -O {$operation} -o ControlPath=".self::muxSocket($server).' ';
-        if (data_get($server, 'settings.is_cloudflare_tunnel')) {
-            $command .= '-o ProxyCommand="cloudflared access ssh --hostname %h" ';
-        }
-
-        return $command.self::escapedUserAtHost($server);
+        Process::run(self::muxControlCommand($server, 'exit'));
+        self::clearConnectionMetadata($server);
     }
 
     public static function generateScpCommand(Server $server, string $source, string $dest): string
@@ -53,7 +109,16 @@ public static function generateScpCommand(Server $server, string $source, string
         }
 
         if (self::isMultiplexingEnabled()) {
-            $scpCommand .= self::multiplexingOptions($server);
+            try {
+                if (self::ensureMultiplexedConnection($server)) {
+                    $scpCommand .= self::multiplexingOptions($server);
+                }
+            } catch (\Throwable $e) {
+                Log::warning('SSH multiplexing failed for SCP, falling back to non-multiplexed connection', [
+                    'server' => $server->name ?? $server->ip,
+                    'error' => $e->getMessage(),
+                ]);
+            }
         }
 
         if (data_get($server, 'settings.is_cloudflare_tunnel')) {
@@ -84,7 +149,16 @@ public static function generateSshCommand(Server $server, string $command, bool
         $sshCommand = $commandTimeout > 0 ? "timeout {$commandTimeout} ssh " : 'ssh ';
 
         if (! $disableMultiplexing && self::isMultiplexingEnabled()) {
-            $sshCommand .= self::multiplexingOptions($server);
+            try {
+                if (self::ensureMultiplexedConnection($server)) {
+                    $sshCommand .= self::multiplexingOptions($server);
+                }
+            } catch (\Throwable $e) {
+                Log::warning('SSH multiplexing failed, falling back to non-multiplexed connection', [
+                    'server' => $server->name ?? $server->ip,
+                    'error' => $e->getMessage(),
+                ]);
+            }
         }
 
         if (data_get($server, 'settings.is_cloudflare_tunnel')) {
@@ -101,6 +175,99 @@ public static function generateSshCommand(Server $server, string $command, bool
             .$delimiter;
     }
 
+    public static function getConnectionTimeout(Server $server): int
+    {
+        $timeout = data_get($server, 'settings.connection_timeout');
+
+        return is_numeric($timeout) && (int) $timeout > 0
+            ? (int) $timeout
+            : (int) config('constants.ssh.connection_timeout');
+    }
+
+    public static function isConnectionHealthy(Server $server): bool
+    {
+        $sshConfig = self::serverSshConfiguration($server);
+        $muxSocket = $sshConfig['muxFilename'];
+        $healthCheckTimeout = config('constants.ssh.mux_health_check_timeout');
+
+        $healthCommand = "timeout $healthCheckTimeout ssh -o ControlMaster=auto -o ControlPath=$muxSocket ";
+        if (data_get($server, 'settings.is_cloudflare_tunnel')) {
+            $healthCommand .= '-o ProxyCommand="cloudflared access ssh --hostname %h" ';
+        }
+        $healthCommand .= self::escapedUserAtHost($server)." 'echo \"health_check_ok\"'";
+
+        $process = Process::run($healthCommand);
+
+        return $process->exitCode() === 0 && str_contains($process->output(), 'health_check_ok');
+    }
+
+    public static function isConnectionExpired(Server $server): bool
+    {
+        $connectionAge = self::getConnectionAge($server);
+        $maxAge = config('constants.ssh.mux_max_age');
+
+        return $connectionAge !== null && $connectionAge > $maxAge;
+    }
+
+    public static function getConnectionAge(Server $server): ?int
+    {
+        $connectionTime = Cache::get("ssh_mux_connection_time_{$server->uuid}");
+
+        if ($connectionTime === null) {
+            return null;
+        }
+
+        return time() - $connectionTime;
+    }
+
+    public static function refreshMultiplexedConnection(Server $server): bool
+    {
+        self::removeMuxFile($server);
+
+        return self::establishNewMultiplexedConnection($server);
+    }
+
+    private static function connectionLockKey(Server $server): string
+    {
+        return 'ssh_mux_lock_'.(gethostname() ?: 'unknown').'_'.$server->uuid;
+    }
+
+    private static function masterConnectionExists(Server $server): bool
+    {
+        return Process::run(self::muxControlCommand($server, 'check'))->exitCode() === 0;
+    }
+
+    private static function connectionIsReusable(Server $server): bool
+    {
+        if (! self::masterConnectionExists($server)) {
+            return false;
+        }
+
+        if (self::getConnectionAge($server) === null) {
+            self::storeConnectionMetadata($server);
+        }
+
+        if (self::isConnectionExpired($server)) {
+            return false;
+        }
+
+        if (config('constants.ssh.mux_health_check_enabled') && ! self::isConnectionHealthy($server)) {
+            return false;
+        }
+
+        return true;
+    }
+
+    private static function muxControlCommand(Server $server, string $operation): string
+    {
+        $command = "ssh -O {$operation} -o ControlPath=".self::muxSocket($server).' ';
+        if (data_get($server, 'settings.is_cloudflare_tunnel')) {
+            $command .= '-o ProxyCommand="cloudflared access ssh --hostname %h" ';
+        }
+
+        return $command.self::escapedUserAtHost($server);
+    }
+
     private static function multiplexingOptions(Server $server): string
     {
         return '-o ControlMaster=auto '
@@ -158,15 +325,6 @@ private static function validateSshKey(PrivateKey $privateKey): void
         }
     }
 
-    public static function getConnectionTimeout(Server $server): int
-    {
-        $timeout = data_get($server, 'settings.connection_timeout');
-
-        return is_numeric($timeout) && (int) $timeout > 0
-            ? (int) $timeout
-            : (int) config('constants.ssh.connection_timeout');
-    }
-
     private static function getCommonSshOptions(Server $server, string $sshKeyLocation, int $connectionTimeout, int $serverInterval, bool $isScp = false): string
     {
         $options = "-i {$sshKeyLocation} "
@@ -183,4 +341,14 @@ private static function getCommonSshOptions(Server $server, string $sshKeyLocati
 
         return $options.'-p '.escapeshellarg((string) $server->port).' ';
     }
+
+    private static function storeConnectionMetadata(Server $server): void
+    {
+        Cache::put("ssh_mux_connection_time_{$server->uuid}", time(), config('constants.ssh.mux_persist_time') + 300);
+    }
+
+    private static function clearConnectionMetadata(Server $server): void
+    {
+        Cache::forget("ssh_mux_connection_time_{$server->uuid}");
+    }
 }
diff --git a/app/Http/Controllers/Api/ApplicationsController.php b/app/Http/Controllers/Api/ApplicationsController.php
index 1f58fbc06..79830ea41 100644
--- a/app/Http/Controllers/Api/ApplicationsController.php
+++ b/app/Http/Controllers/Api/ApplicationsController.php
@@ -150,7 +150,7 @@ public function applications(Request $request)
                     mediaType: 'application/json',
                     schema: new OA\Schema(
                         type: 'object',
-                        required: ['project_uuid', 'server_uuid', 'environment_name', 'environment_uuid', 'git_repository', 'git_branch', 'build_pack', 'ports_exposes'],
+                        required: ['project_uuid', 'server_uuid', 'environment_name', 'environment_uuid', 'git_repository', 'git_branch', 'build_pack'],
                         properties: [
                             'project_uuid' => ['type' => 'string', 'description' => 'The project UUID.'],
                             'server_uuid' => ['type' => 'string', 'description' => 'The server UUID.'],
@@ -316,7 +316,7 @@ public function create_public_application(Request $request)
                     mediaType: 'application/json',
                     schema: new OA\Schema(
                         type: 'object',
-                        required: ['project_uuid', 'server_uuid', 'environment_name', 'environment_uuid', 'github_app_uuid', 'git_repository', 'git_branch', 'build_pack', 'ports_exposes'],
+                        required: ['project_uuid', 'server_uuid', 'environment_name', 'environment_uuid', 'github_app_uuid', 'git_repository', 'git_branch', 'build_pack'],
                         properties: [
                             'project_uuid' => ['type' => 'string', 'description' => 'The project UUID.'],
                             'server_uuid' => ['type' => 'string', 'description' => 'The server UUID.'],
@@ -482,7 +482,7 @@ public function create_private_gh_app_application(Request $request)
                     mediaType: 'application/json',
                     schema: new OA\Schema(
                         type: 'object',
-                        required: ['project_uuid', 'server_uuid', 'environment_name', 'environment_uuid', 'private_key_uuid', 'git_repository', 'git_branch', 'build_pack', 'ports_exposes'],
+                        required: ['project_uuid', 'server_uuid', 'environment_name', 'environment_uuid', 'private_key_uuid', 'git_repository', 'git_branch', 'build_pack'],
                         properties: [
                             'project_uuid' => ['type' => 'string', 'description' => 'The project UUID.'],
                             'server_uuid' => ['type' => 'string', 'description' => 'The server UUID.'],
@@ -785,7 +785,7 @@ public function create_dockerfile_application(Request $request)
                     mediaType: 'application/json',
                     schema: new OA\Schema(
                         type: 'object',
-                        required: ['project_uuid', 'server_uuid', 'environment_name', 'environment_uuid', 'docker_registry_image_name', 'ports_exposes'],
+                        required: ['project_uuid', 'server_uuid', 'environment_name', 'environment_uuid', 'docker_registry_image_name'],
                         properties: [
                             'project_uuid' => ['type' => 'string', 'description' => 'The project UUID.'],
                             'server_uuid' => ['type' => 'string', 'description' => 'The server UUID.'],
@@ -1028,7 +1028,7 @@ private function create_application(Request $request, $type)
                 'git_repository' => ['string', 'required', new ValidGitRepositoryUrl],
                 'git_branch' => ['string', 'required', new ValidGitBranch],
                 'build_pack' => ['required', Rule::enum(BuildPackTypes::class)],
-                'ports_exposes' => 'string|regex:/^(\d+)(,\d+)*$/|required',
+                'ports_exposes' => 'string|regex:/^(\d+)(,\d+)*$/|nullable',
                 'docker_compose_domains' => 'array|nullable',
                 'docker_compose_domains.*' => 'array:name,domain',
                 'docker_compose_domains.*.name' => 'string|required',
@@ -1234,7 +1234,7 @@ private function create_application(Request $request, $type)
                 'git_repository' => 'string|required',
                 'git_branch' => ['string', 'required', new ValidGitBranch],
                 'build_pack' => ['required', Rule::enum(BuildPackTypes::class)],
-                'ports_exposes' => 'string|regex:/^(\d+)(,\d+)*$/|required',
+                'ports_exposes' => 'string|regex:/^(\d+)(,\d+)*$/|nullable',
                 'github_app_uuid' => 'string|required',
                 'watch_paths' => 'string|nullable',
                 'docker_compose_domains' => 'array|nullable',
@@ -1474,7 +1474,7 @@ private function create_application(Request $request, $type)
                 'git_repository' => ['string', 'required', new ValidGitRepositoryUrl],
                 'git_branch' => ['string', 'required', new ValidGitBranch],
                 'build_pack' => ['required', Rule::enum(BuildPackTypes::class)],
-                'ports_exposes' => 'string|regex:/^(\d+)(,\d+)*$/|required',
+                'ports_exposes' => 'string|regex:/^(\d+)(,\d+)*$/|nullable',
                 'private_key_uuid' => 'string|required',
                 'watch_paths' => 'string|nullable',
                 'docker_compose_domains' => 'array|nullable',
@@ -1797,7 +1797,7 @@ private function create_application(Request $request, $type)
             $validationRules = [
                 'docker_registry_image_name' => ['required', 'string', 'max:255', new DockerImageFormat],
                 'docker_registry_image_tag' => ValidationPatterns::dockerImageTagRules(),
-                'ports_exposes' => 'string|regex:/^(\d+)(,\d+)*$/|required',
+                'ports_exposes' => 'string|regex:/^(\d+)(,\d+)*$/|nullable',
             ];
             $validationRules = array_merge(sharedDataApplications(), $validationRules);
             $validator = customApiValidator($request->all(), $validationRules);
diff --git a/app/Http/Controllers/Api/ServersController.php b/app/Http/Controllers/Api/ServersController.php
index 30cafad3f..f4efc8577 100644
--- a/app/Http/Controllers/Api/ServersController.php
+++ b/app/Http/Controllers/Api/ServersController.php
@@ -13,6 +13,7 @@
 use App\Models\Project;
 use App\Models\Server as ModelsServer;
 use App\Rules\ValidServerIp;
+use App\Support\ValidationPatterns;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
 use OpenApi\Attributes as OA;
@@ -489,10 +490,12 @@ public function create_server(Request $request)
             'ip' => ['string', 'required', new ValidServerIp],
             'port' => 'integer|nullable|between:1,65535',
             'private_key_uuid' => 'string|required',
-            'user' => ['string', 'nullable', 'regex:/^[a-zA-Z0-9_-]+$/'],
+            'user' => ValidationPatterns::serverUsernameRules(required: false),
             'is_build_server' => 'boolean|nullable',
             'instant_validate' => 'boolean|nullable',
             'proxy_type' => 'string|nullable',
+        ], [
+            ...ValidationPatterns::serverUsernameMessages(),
         ]);
 
         $extraFields = array_diff(array_keys($request->all()), $allowedFields);
@@ -668,7 +671,7 @@ public function update_server(Request $request)
             'ip' => ['string', 'nullable', new ValidServerIp],
             'port' => 'integer|nullable|between:1,65535',
             'private_key_uuid' => 'string|nullable',
-            'user' => ['string', 'nullable', 'regex:/^[a-zA-Z0-9_-]+$/'],
+            'user' => ValidationPatterns::serverUsernameRules(required: false),
             'is_build_server' => 'boolean|nullable',
             'instant_validate' => 'boolean|nullable',
             'proxy_type' => 'string|nullable',
@@ -678,6 +681,8 @@ public function update_server(Request $request)
             'server_disk_usage_notification_threshold' => 'integer|min:1|max:100',
             'server_disk_usage_check_frequency' => 'string',
             'connection_timeout' => 'integer|min:1|max:300',
+        ], [
+            ...ValidationPatterns::serverUsernameMessages(),
         ]);
 
         $extraFields = array_diff(array_keys($request->all()), $allowedFields);
@@ -703,17 +708,17 @@ public function update_server(Request $request)
             $validProxyTypes = collect(ProxyTypes::cases())->map(function ($proxyType) {
                 return str($proxyType->value)->lower();
             });
-            if ($validProxyTypes->contains(str($request->proxy_type)->lower())) {
-                $server->changeProxy($request->proxy_type, async: true);
-            } else {
+            if (! $validProxyTypes->contains(str($request->proxy_type)->lower())) {
                 return response()->json(['message' => 'Invalid proxy type.'], 422);
             }
         }
-        $server->update($request->only(['name', 'description', 'ip', 'port', 'user']));
-        if ($request->is_build_server) {
-            $server->settings()->update([
-                'is_build_server' => $request->is_build_server,
-            ]);
+        $updateFields = $request->only(['name', 'description', 'ip', 'port', 'user']);
+        if ($request->filled('private_key_uuid')) {
+            $privateKey = PrivateKey::whereTeamId($teamId)->whereUuid($request->private_key_uuid)->first();
+            if (! $privateKey) {
+                return response()->json(['message' => 'Private key not found.'], 404);
+            }
+            $updateFields['private_key_id'] = $privateKey->id;
         }
 
         if ($request->has('server_disk_usage_check_frequency') && ! validate_cron_expression($request->server_disk_usage_check_frequency)) {
@@ -723,11 +728,22 @@ public function update_server(Request $request)
             ], 422);
         }
 
+        $server->update($updateFields);
+        if ($request->has('is_build_server')) {
+            $server->settings()->update([
+                'is_build_server' => $request->boolean('is_build_server'),
+            ]);
+        }
+
         $advancedSettings = $request->only(['concurrent_builds', 'dynamic_timeout', 'deployment_queue_limit', 'server_disk_usage_notification_threshold', 'server_disk_usage_check_frequency', 'connection_timeout']);
         if (! empty($advancedSettings)) {
             $server->settings()->update(array_filter($advancedSettings, fn ($value) => ! is_null($value)));
         }
 
+        if ($request->proxy_type) {
+            $server->changeProxy($request->proxy_type, async: true);
+        }
+
         if ($request->instant_validate) {
             ValidateServer::dispatch($server);
         }
diff --git a/app/Http/Controllers/Controller.php b/app/Http/Controllers/Controller.php
index 6ce6b6d57..3090538c3 100644
--- a/app/Http/Controllers/Controller.php
+++ b/app/Http/Controllers/Controller.php
@@ -7,6 +7,7 @@
 use App\Models\User;
 use App\Providers\RouteServiceProvider;
 use Illuminate\Auth\Events\Verified;
+use Illuminate\Contracts\Encryption\DecryptException;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Foundation\Validation\ValidatesRequests;
 use Illuminate\Http\Request;
@@ -98,23 +99,50 @@ public function link()
     {
         $token = request()->get('token');
         if ($token) {
-            $decrypted = Crypt::decryptString($token);
-            $email = str($decrypted)->before('@@@');
-            $password = str($decrypted)->after('@@@');
+            try {
+                $decrypted = Crypt::decryptString($token);
+            } catch (DecryptException) {
+                return redirect()->route('login')->with('error', 'Invalid credentials.');
+            }
+
+            if (! str_contains($decrypted, '@@@')) {
+                return redirect()->route('login')->with('error', 'Invalid credentials.');
+            }
+
+            $payload = explode('@@@', $decrypted, 3);
+            if (count($payload) === 3) {
+                [$email, $invitationUuid, $password] = $payload;
+            } else {
+                [$email, $password] = $payload;
+                $invitationUuid = null;
+            }
+
+            $email = Str::lower($email);
             $user = User::whereEmail($email)->first();
             if (! $user) {
                 return redirect()->route('login');
             }
+
+            $invitation = TeamInvitation::query()
+                ->where('email', $email)
+                ->when($invitationUuid, fn ($query) => $query->where('uuid', $invitationUuid))
+                ->where('link', request()->fullUrl())
+                ->first();
+            if (! $invitation || ! $invitation->isValid()) {
+                return redirect()->route('login')->with('error', 'Invitation has expired or been revoked.');
+            }
+
             if (Hash::check($password, $user->password)) {
-                $invitation = TeamInvitation::whereEmail($email);
-                if ($invitation->exists()) {
-                    $team = $invitation->first()->team;
-                    $user->teams()->attach($team->id, ['role' => $invitation->first()->role]);
-                    $invitation->delete();
-                } else {
-                    $team = $user->teams()->first();
+                $team = $invitation->team;
+                if (! $user->teams()->where('team_id', $team->id)->exists()) {
+                    $user->teams()->attach($team->id, ['role' => $invitation->role]);
                 }
+                $invitation->delete();
+
                 Auth::login($user);
+                $user->forceFill([
+                    'password' => Hash::make(Str::random(64)),
+                ])->save();
                 session(['currentTeam' => $team]);
 
                 return redirect()->route('dashboard');
diff --git a/app/Http/Controllers/Webhook/Github.php b/app/Http/Controllers/Webhook/Github.php
index 8e3ffcd7c..40c5cbdf0 100644
--- a/app/Http/Controllers/Webhook/Github.php
+++ b/app/Http/Controllers/Webhook/Github.php
@@ -11,6 +11,8 @@
 use App\Models\GithubApp;
 use App\Models\PrivateKey;
 use Exception;
+use Illuminate\Http\Exceptions\HttpResponseException;
+use Illuminate\Http\RedirectResponse;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Cache;
 use Illuminate\Support\Facades\Http;
@@ -539,19 +541,22 @@ public function redirect(Request $request)
 
     public function install(Request $request)
     {
-        $source = (string) $request->query('source', '');
-        abort_if(blank($source), 404);
-
-        $github_app = GithubApp::ownedByCurrentTeam()->where('uuid', $source)->firstOrFail();
-
         $setup_action = (string) $request->query('setup_action', '');
-        if ($setup_action !== 'install') {
-            return redirect()->route('source.github.show', ['github_app_uuid' => $github_app->uuid]);
-        }
+        abort_unless(in_array($setup_action, ['install', 'update'], true), 422, 'Invalid GitHub App setup action.');
 
         $installation_id = (string) $request->query('installation_id', '');
         abort_unless(ctype_digit($installation_id), 422, 'Missing GitHub App installation id.');
 
+        if ($setup_action === 'update') {
+            return $this->redirectAfterGithubAppInstallationUpdate($installation_id);
+        }
+
+        $github_app = $this->consumeGithubAppSetupState(
+            request: $request,
+            state: (string) $request->query('state', ''),
+            action: 'install',
+        );
+
         abort_unless(
             $this->githubInstallationBelongsToApp($github_app, $installation_id),
             403,
@@ -564,6 +569,19 @@ public function install(Request $request)
         return redirect()->route('source.github.show', ['github_app_uuid' => $github_app->uuid]);
     }
 
+    private function redirectAfterGithubAppInstallationUpdate(string $installation_id): RedirectResponse
+    {
+        $github_app = GithubApp::ownedByCurrentTeam()
+            ->where('installation_id', $installation_id)
+            ->first();
+
+        if ($github_app) {
+            return redirect()->route('source.github.show', ['github_app_uuid' => $github_app->uuid]);
+        }
+
+        return redirect()->route('source.all');
+    }
+
     /**
      * Verify that the given installation id actually belongs to this GitHub App.
      *
@@ -596,11 +614,14 @@ private function githubInstallationBelongsToApp(GithubApp $github_app, string $i
 
     private function consumeGithubAppSetupState(Request $request, string $state, string $action): GithubApp
     {
-        abort_if(blank($state), 404);
+        if (blank($state)) {
+            $this->rejectInvalidGithubAppSetupState($request);
+        }
 
         $payload = Cache::pull($this->githubAppSetupStateCacheKey($state));
-        abort_unless(is_array($payload), 404);
-        abort_unless(data_get($payload, 'action') === $action, 404);
+        if (! is_array($payload) || data_get($payload, 'action') !== $action) {
+            $this->rejectInvalidGithubAppSetupState($request);
+        }
 
         $team_id = $request->user()?->currentTeam()?->id;
         abort_unless(! is_null($team_id) && (int) data_get($payload, 'team_id') === $team_id, 403);
@@ -610,6 +631,18 @@ private function consumeGithubAppSetupState(Request $request, string $state, str
             ->firstOrFail();
     }
 
+    private function rejectInvalidGithubAppSetupState(Request $request): never
+    {
+        if ($request->expectsJson()) {
+            abort(404);
+        }
+
+        throw new HttpResponseException(
+            redirect()
+                ->route('source.all')
+        );
+    }
+
     private function githubAppSetupStateCacheKey(string $state): string
     {
         return 'github-app-setup-state:'.hash('sha256', $state);
diff --git a/app/Jobs/ApplicationDeploymentJob.php b/app/Jobs/ApplicationDeploymentJob.php
index a1478aaff..1b8ef3fc4 100644
--- a/app/Jobs/ApplicationDeploymentJob.php
+++ b/app/Jobs/ApplicationDeploymentJob.php
@@ -1388,7 +1388,7 @@ private function generate_runtime_environment_variables()
 
             // Add PORT if not exists, use the first port as default
             if ($this->build_pack !== 'dockercompose') {
-                if ($this->application->environment_variables->where('key', 'PORT')->isEmpty()) {
+                if ($this->application->environment_variables->where('key', 'PORT')->isEmpty() && ! empty($ports)) {
                     $envs->push("PORT={$ports[0]}");
                 }
             }
@@ -2129,21 +2129,23 @@ private function prepare_builder_image(bool $firstTry = true)
         $helperImage = "{$helperImage}:".getHelperVersion();
         // Get user home directory
         $this->serverUserHomeDir = instant_remote_process(['echo $HOME'], $this->server);
+        instant_remote_process(["mkdir -p {$this->serverUserHomeDir}/.docker/buildx"], $this->server);
         $this->dockerConfigFileExists = instant_remote_process(["test -f {$this->serverUserHomeDir}/.docker/config.json && echo 'OK' || echo 'NOK'"], $this->server);
 
         $env_flags = $this->generate_docker_env_flags_for_secrets();
+        $buildxMetadataVolume = "-v {$this->serverUserHomeDir}/.docker/buildx:/root/.docker/buildx";
         if ($this->use_build_server) {
             if ($this->dockerConfigFileExists === 'NOK') {
                 throw new DeploymentException('Docker config file (~/.docker/config.json) not found on the build server. Please run "docker login" to login to the docker registry on the server.');
             }
-            $runCommand = "docker run -d --name {$this->deployment_uuid} {$env_flags} --rm -v {$this->serverUserHomeDir}/.docker/config.json:/root/.docker/config.json:ro -v /var/run/docker.sock:/var/run/docker.sock {$helperImage}";
+            $runCommand = "docker run -d --name {$this->deployment_uuid} {$env_flags} --rm -v {$this->serverUserHomeDir}/.docker/config.json:/root/.docker/config.json:ro {$buildxMetadataVolume} -v /var/run/docker.sock:/var/run/docker.sock {$helperImage}";
         } else {
             if ($this->dockerConfigFileExists === 'OK') {
                 $safeNetwork = escapeshellarg($this->destination->network);
-                $runCommand = "docker run -d --network {$safeNetwork} --name {$this->deployment_uuid} {$env_flags} --rm -v {$this->serverUserHomeDir}/.docker/config.json:/root/.docker/config.json:ro -v /var/run/docker.sock:/var/run/docker.sock {$helperImage}";
+                $runCommand = "docker run -d --network {$safeNetwork} --name {$this->deployment_uuid} {$env_flags} --rm -v {$this->serverUserHomeDir}/.docker/config.json:/root/.docker/config.json:ro {$buildxMetadataVolume} -v /var/run/docker.sock:/var/run/docker.sock {$helperImage}";
             } else {
                 $safeNetwork = escapeshellarg($this->destination->network);
-                $runCommand = "docker run -d --network {$safeNetwork} --name {$this->deployment_uuid} {$env_flags} --rm -v /var/run/docker.sock:/var/run/docker.sock {$helperImage}";
+                $runCommand = "docker run -d --network {$safeNetwork} --name {$this->deployment_uuid} {$env_flags} --rm {$buildxMetadataVolume} -v /var/run/docker.sock:/var/run/docker.sock {$helperImage}";
             }
         }
         if ($firstTry) {
@@ -2258,7 +2260,7 @@ private function gitLsRemoteCommand(string $lsRemoteRef, ?string $identityFile =
         $sshCommand = "ssh -o ConnectTimeout=30 -p {$this->customPort} -o Port={$this->customPort} -o LogLevel=ERROR -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null";
 
         if ($identityFile !== null) {
-            $sshCommand .= " -i {$identityFile}";
+            $sshCommand .= " -i {$identityFile} -o IdentitiesOnly=yes";
         }
 
         return 'GIT_SSH_COMMAND="'.$sshCommand.'" git ls-remote '.escapeshellarg($this->fullRepoUrl).' '.escapeshellarg($lsRemoteRef);
@@ -2298,18 +2300,19 @@ private function check_git_if_build_needed()
         $private_key = data_get($this->application, 'private_key.private_key');
         if ($private_key) {
             $private_key = base64_encode($private_key);
+            $customSshKeyLocation = "/root/.ssh/id_rsa_coolify_{$this->deployment_uuid}";
             $this->execute_remote_command(
                 [
                     executeInDocker($this->deployment_uuid, 'mkdir -p /root/.ssh'),
                 ],
                 [
-                    executeInDocker($this->deployment_uuid, "echo '{$private_key}' | base64 -d | tee /root/.ssh/id_rsa > /dev/null"),
+                    executeInDocker($this->deployment_uuid, "echo '{$private_key}' | base64 -d | tee {$customSshKeyLocation} > /dev/null"),
                 ],
                 [
-                    executeInDocker($this->deployment_uuid, 'chmod 600 /root/.ssh/id_rsa'),
+                    executeInDocker($this->deployment_uuid, "chmod 600 {$customSshKeyLocation}"),
                 ],
                 [
-                    executeInDocker($this->deployment_uuid, $this->gitLsRemoteCommand($lsRemoteRef, '/root/.ssh/id_rsa')),
+                    executeInDocker($this->deployment_uuid, $this->gitLsRemoteCommand($lsRemoteRef, $customSshKeyLocation)),
                     'hidden' => true,
                     'save' => 'git_commit_sha',
                 ]
@@ -3136,7 +3139,7 @@ private function generate_compose_file()
                     'image' => $this->production_image_name,
                     'container_name' => $this->container_name,
                     'restart' => RESTART_MODE,
-                    'expose' => $ports,
+                    ...(! empty($ports) ? ['expose' => $ports] : []),
                     'networks' => [
                         $this->destination->network => [
                             'aliases' => array_merge(
@@ -3168,16 +3171,19 @@ private function generate_compose_file()
         // If custom_healthcheck_found is true, the Dockerfile's HEALTHCHECK will be used
         // If healthcheck is disabled, no healthcheck will be added
         if (! $this->application->custom_healthcheck_found && ! $this->application->isHealthcheckDisabled()) {
-            $docker_compose['services'][$this->container_name]['healthcheck'] = [
-                'test' => [
-                    'CMD-SHELL',
-                    $this->generate_healthcheck_commands(),
-                ],
-                'interval' => $this->application->health_check_interval.'s',
-                'timeout' => $this->application->health_check_timeout.'s',
-                'retries' => $this->application->health_check_retries,
-                'start_period' => $this->application->health_check_start_period.'s',
-            ];
+            $healthcheck_command = $this->generate_healthcheck_commands();
+            if ($healthcheck_command !== null) {
+                $docker_compose['services'][$this->container_name]['healthcheck'] = [
+                    'test' => [
+                        'CMD-SHELL',
+                        $healthcheck_command,
+                    ],
+                    'interval' => $this->application->health_check_interval.'s',
+                    'timeout' => $this->application->health_check_timeout.'s',
+                    'retries' => $this->application->health_check_retries,
+                    'start_period' => $this->application->health_check_start_period.'s',
+                ];
+            }
         }
 
         if (! is_null($this->application->limits_cpuset)) {
@@ -3387,7 +3393,11 @@ private function generate_healthcheck_commands()
 
         // HTTP type healthcheck (default)
         if (! $this->application->health_check_port) {
-            $health_check_port = (int) $this->application->ports_exposes_array[0];
+            if (! empty($this->application->ports_exposes_array)) {
+                $health_check_port = (int) $this->application->ports_exposes_array[0];
+            } else {
+                return null;
+            }
         } else {
             $health_check_port = (int) $this->application->health_check_port;
         }
diff --git a/app/Jobs/CleanupStaleMultiplexedConnections.php b/app/Jobs/CleanupStaleMultiplexedConnections.php
new file mode 100644
index 000000000..0d3029c66
--- /dev/null
+++ b/app/Jobs/CleanupStaleMultiplexedConnections.php
@@ -0,0 +1,228 @@
+<?php
+
+namespace App\Jobs;
+
+use App\Models\Server;
+use Carbon\Carbon;
+use Illuminate\Bus\Queueable;
+use Illuminate\Contracts\Queue\ShouldQueue;
+use Illuminate\Foundation\Bus\Dispatchable;
+use Illuminate\Queue\InteractsWithQueue;
+use Illuminate\Queue\SerializesModels;
+use Illuminate\Support\Facades\Log;
+use Illuminate\Support\Facades\Process;
+use Illuminate\Support\Facades\Storage;
+
+class CleanupStaleMultiplexedConnections implements ShouldQueue
+{
+    use Dispatchable, InteractsWithQueue, Queueable, SerializesModels;
+
+    public function handle()
+    {
+        $this->cleanupStaleConnections();
+        $this->cleanupNonExistentServerConnections();
+        $this->cleanupOrphanedSshProcesses();
+        $this->cleanupOrphanedCloudflaredProcesses();
+    }
+
+    /**
+     * Kill backgrounded ssh master processes that lost the ControlPath socket
+     * race. Such processes are not masters, so ControlPersist never reaps them
+     * and they leak memory until the container restarts. A legitimate master
+     * always owns its socket file; an orphan has none.
+     *
+     * Processes younger than the minimum age are skipped: a freshly forked
+     * master creates its socket a few milliseconds after starting, so a young
+     * process with no socket may simply be mid-establish rather than orphaned.
+     */
+    private function cleanupOrphanedSshProcesses(): void
+    {
+        $muxDir = storage_path('app/ssh/mux');
+        $minAge = (int) config('constants.ssh.mux_orphan_min_age');
+
+        foreach ($this->listProcesses() as $process) {
+            // Backgrounded ssh master: current `ssh -fN` or legacy `ssh -fNM`.
+            if (! preg_match('#(^|/)ssh -fN#', $process['args'])) {
+                continue;
+            }
+
+            // Only ever touch ssh processes pointing at Coolify's mux directory.
+            if (! preg_match('#ControlPath=('.preg_quote($muxDir, '#').'/\S+)#', $process['args'], $pathMatch)) {
+                continue;
+            }
+
+            if ($process['etimes'] >= $minAge && ! file_exists($pathMatch[1])) {
+                $this->reapOrphan('ssh', $process);
+            }
+        }
+    }
+
+    /**
+     * Kill orphaned `cloudflared access ssh` proxy processes. Each is spawned
+     * as the SSH ProxyCommand transport for a Cloudflare Tunnel server and must
+     * die with its parent ssh. When that ssh is killed or orphaned (e.g. a lost
+     * mux master), the cloudflared process can leak and accumulate. A legitimate
+     * proxy always has a live ssh parent; one without is safe to reap.
+     *
+     * Processes younger than the minimum age are skipped so a proxy whose parent
+     * ssh is still starting up, or a transient `ssh -O check` proxy mid-exit, is
+     * never mistaken for an orphan.
+     */
+    private function cleanupOrphanedCloudflaredProcesses(): void
+    {
+        $minAge = (int) config('constants.ssh.mux_orphan_min_age');
+        $processes = $this->listProcesses();
+
+        $sshPids = [];
+        foreach ($processes as $process) {
+            // The ssh binary itself, not `cloudflared access ssh` (space before ssh).
+            if (preg_match('#(^|/)ssh\s#', $process['args'])) {
+                $sshPids[$process['pid']] = true;
+            }
+        }
+
+        foreach ($processes as $process) {
+            // `cloudflared access ssh`, never the `cloudflared tunnel` daemon.
+            if (! str_contains($process['args'], 'cloudflared access ssh')) {
+                continue;
+            }
+
+            // Orphaned when no live ssh process is its parent.
+            if ($process['etimes'] >= $minAge && ! isset($sshPids[$process['ppid']])) {
+                $this->reapOrphan('cloudflared', $process);
+            }
+        }
+    }
+
+    /**
+     * Reap a detected orphan process. When orphan reaping is disabled (the
+     * default), the orphan is only logged — a dry-run mode that lets operators
+     * verify what would be killed before enabling it for real.
+     *
+     * @param  array{pid: string, ppid: string, etimes: int, args: string}  $process
+     */
+    private function reapOrphan(string $kind, array $process): void
+    {
+        if (! config('constants.ssh.mux_orphan_reap_enabled')) {
+            Log::info("Orphaned {$kind} process detected (dry-run, not killed)", [
+                'pid' => $process['pid'],
+                'etimes' => $process['etimes'],
+                'command' => $process['args'],
+            ]);
+
+            return;
+        }
+
+        Process::run('kill '.escapeshellarg($process['pid']));
+        Log::info("Killed orphaned {$kind} process", [
+            'pid' => $process['pid'],
+            'etimes' => $process['etimes'],
+            'command' => $process['args'],
+        ]);
+    }
+
+    /**
+     * Snapshot of running processes.
+     *
+     * @return list<array{pid: string, ppid: string, etimes: int, args: string}>
+     */
+    private function listProcesses(): array
+    {
+        $ps = Process::run('ps -ww -eo pid=,ppid=,etimes=,args=');
+        if ($ps->exitCode() !== 0) {
+            return [];
+        }
+
+        $processes = [];
+        foreach (explode("\n", trim($ps->output())) as $line) {
+            if (! preg_match('/^\s*(\d+)\s+(\d+)\s+(\d+)\s+(.*)$/', $line, $matches)) {
+                continue;
+            }
+            $processes[] = [
+                'pid' => $matches[1],
+                'ppid' => $matches[2],
+                'etimes' => (int) $matches[3],
+                'args' => $matches[4],
+            ];
+        }
+
+        return $processes;
+    }
+
+    private function cleanupStaleConnections()
+    {
+        $muxFiles = Storage::disk('ssh-mux')->files();
+
+        foreach ($muxFiles as $muxFile) {
+            $serverUuid = $this->extractServerUuidFromMuxFile($muxFile);
+            $server = Server::where('uuid', $serverUuid)->first();
+
+            if (! $server) {
+                $this->removeMultiplexFile($muxFile, 'server_not_found');
+
+                continue;
+            }
+
+            $muxSocket = "/var/www/html/storage/app/ssh/mux/{$muxFile}";
+            $checkCommand = "ssh -O check -o ControlPath={$muxSocket} {$server->user}@{$server->ip} 2>/dev/null";
+            $checkProcess = Process::run($checkCommand);
+
+            if ($checkProcess->exitCode() !== 0) {
+                $this->removeMultiplexFile($muxFile, 'connection_check_failed');
+            } else {
+                $muxContent = Storage::disk('ssh-mux')->get($muxFile);
+                $establishedAt = Carbon::parse(substr($muxContent, 37));
+                $expirationTime = $establishedAt->addSeconds(config('constants.ssh.mux_persist_time'));
+
+                if (Carbon::now()->isAfter($expirationTime)) {
+                    $this->removeMultiplexFile($muxFile, 'expired');
+                }
+            }
+        }
+    }
+
+    private function cleanupNonExistentServerConnections()
+    {
+        $muxFiles = Storage::disk('ssh-mux')->files();
+        $existingServerUuids = Server::pluck('uuid')->toArray();
+
+        foreach ($muxFiles as $muxFile) {
+            $serverUuid = $this->extractServerUuidFromMuxFile($muxFile);
+            if (! in_array($serverUuid, $existingServerUuids)) {
+                $this->removeMultiplexFile($muxFile, 'server_does_not_exist');
+            }
+        }
+    }
+
+    private function extractServerUuidFromMuxFile($muxFile)
+    {
+        return substr($muxFile, 4);
+    }
+
+    /**
+     * Close and delete a stale mux socket file. When orphan reaping is disabled
+     * (the default), the file is only logged — a dry-run mode that lets operators
+     * verify what would be removed before enabling it for real.
+     */
+    private function removeMultiplexFile(string $muxFile, string $reason): void
+    {
+        if (! config('constants.ssh.mux_orphan_reap_enabled')) {
+            Log::info('Stale mux file detected (dry-run, not removed)', [
+                'file' => $muxFile,
+                'reason' => $reason,
+            ]);
+
+            return;
+        }
+
+        $muxSocket = "/var/www/html/storage/app/ssh/mux/{$muxFile}";
+        $closeCommand = "ssh -O exit -o ControlPath={$muxSocket} localhost 2>/dev/null";
+        Process::run($closeCommand);
+        Storage::disk('ssh-mux')->delete($muxFile);
+
+        Log::info('Removed stale mux file', [
+            'file' => $muxFile,
+            'reason' => $reason,
+        ]);
+    }
+}
diff --git a/app/Jobs/SendWebhookJob.php b/app/Jobs/SendWebhookJob.php
index 9d2a94606..17517cebb 100644
--- a/app/Jobs/SendWebhookJob.php
+++ b/app/Jobs/SendWebhookJob.php
@@ -2,6 +2,7 @@
 
 namespace App\Jobs;
 
+use App\Rules\SafeWebhookUrl;
 use Illuminate\Bus\Queueable;
 use Illuminate\Contracts\Queue\ShouldBeEncrypted;
 use Illuminate\Contracts\Queue\ShouldQueue;
@@ -44,7 +45,7 @@ public function handle(): void
     {
         $validator = Validator::make(
             ['webhook_url' => $this->webhookUrl],
-            ['webhook_url' => ['required', 'url', new \App\Rules\SafeWebhookUrl]]
+            ['webhook_url' => ['required', 'url', new SafeWebhookUrl]]
         );
 
         if ($validator->fails()) {
diff --git a/app/Livewire/Boarding/Index.php b/app/Livewire/Boarding/Index.php
index b16f1abde..d57c06952 100644
--- a/app/Livewire/Boarding/Index.php
+++ b/app/Livewire/Boarding/Index.php
@@ -8,6 +8,7 @@
 use App\Models\Server;
 use App\Models\Team;
 use App\Services\ConfigurationRepository;
+use App\Support\ValidationPatterns;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Collection;
 use Livewire\Attributes\Url;
@@ -218,6 +219,23 @@ private function updateServerDetails()
         }
     }
 
+    protected function rules(): array
+    {
+        return [
+            'remoteServerName' => 'required|string',
+            'remoteServerHost' => 'required|string',
+            'remoteServerPort' => 'required|integer|min:1|max:65535',
+            'remoteServerUser' => ValidationPatterns::serverUsernameRules(),
+        ];
+    }
+
+    protected function messages(): array
+    {
+        return [
+            ...ValidationPatterns::serverUsernameMessages('remoteServerUser', 'SSH User'),
+        ];
+    }
+
     public function getProxyType()
     {
         $this->selectProxy(ProxyTypes::TRAEFIK->value);
@@ -281,12 +299,7 @@ public function savePrivateKey()
 
     public function saveServer()
     {
-        $this->validate([
-            'remoteServerName' => 'required|string',
-            'remoteServerHost' => 'required|string',
-            'remoteServerPort' => 'required|integer',
-            'remoteServerUser' => 'required|string',
-        ]);
+        $this->validate();
 
         try {
             $this->authorize('create', Server::class);
@@ -478,10 +491,10 @@ public function showNewResource()
 
     public function saveAndValidateServer()
     {
-        $this->validate([
-            'remoteServerPort' => 'required|integer|min:1|max:65535',
-            'remoteServerUser' => 'required|string',
-        ]);
+        $this->validate(array_intersect_key($this->rules(), array_flip([
+            'remoteServerPort',
+            'remoteServerUser',
+        ])));
 
         $this->createdServer->update([
             'port' => $this->remoteServerPort,
diff --git a/app/Livewire/Destination/Resources.php b/app/Livewire/Destination/Resources.php
new file mode 100644
index 000000000..c71010411
--- /dev/null
+++ b/app/Livewire/Destination/Resources.php
@@ -0,0 +1,125 @@
+<?php
+
+namespace App\Livewire\Destination;
+
+use App\Models\Application;
+use App\Models\BaseModel;
+use App\Models\Service;
+use App\Models\StandaloneClickhouse;
+use App\Models\StandaloneDocker;
+use App\Models\StandaloneDragonfly;
+use App\Models\StandaloneKeydb;
+use App\Models\StandaloneMariadb;
+use App\Models\StandaloneMongodb;
+use App\Models\StandaloneMysql;
+use App\Models\StandalonePostgresql;
+use App\Models\StandaloneRedis;
+use Illuminate\Contracts\View\View;
+use Livewire\Attributes\Locked;
+use Livewire\Component;
+
+class Resources extends Component
+{
+    #[Locked]
+    public $destination;
+
+    public array $resources = [];
+
+    public function mount(string $destination_uuid)
+    {
+        try {
+            $destination = find_destination_for_current_team($destination_uuid);
+            if (! $destination) {
+                return redirect()->route('destination.index');
+            }
+            if (! $destination instanceof StandaloneDocker) {
+                return redirect()->route('destination.show', ['destination_uuid' => $destination->uuid]);
+            }
+
+            $this->destination = $destination;
+            $this->loadResources();
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
+    }
+
+    /**
+     * Load applications, services, and database resources deployed to the standalone Docker destination.
+     *
+     * @return void Populates the resources property for display.
+     */
+    public function loadResources(): void
+    {
+        $this->resources = $this->collectResources([
+            $this->destination->applications,
+            $this->destination->services,
+            $this->destination->postgresqls,
+            $this->destination->redis,
+            $this->destination->mongodbs,
+            $this->destination->mysqls,
+            $this->destination->mariadbs,
+            $this->destination->keydbs,
+            $this->destination->dragonflies,
+            $this->destination->clickhouses,
+        ]);
+    }
+
+    /**
+     * @param  array<int, iterable<Application|Service|StandalonePostgresql|StandaloneRedis|StandaloneMongodb|StandaloneMysql|StandaloneMariadb|StandaloneKeydb|StandaloneDragonfly|StandaloneClickhouse>>  $groups
+     * @return array<int, array{uuid:string,type:string,name:string,project:string|null,environment:string|null,url:string|null,search:string}>
+     */
+    protected function collectResources(array $groups): array
+    {
+        $rows = [];
+        foreach ($groups as $group) {
+            foreach ($group as $resource) {
+                $rows[] = $this->resourceRow($resource);
+            }
+        }
+
+        return $rows;
+    }
+
+    /**
+     * @param  Application|Service|StandalonePostgresql|StandaloneRedis|StandaloneMongodb|StandaloneMysql|StandaloneMariadb|StandaloneKeydb|StandaloneDragonfly|StandaloneClickhouse  $resource
+     * @return array{uuid:string,type:string,name:string,project:string|null,environment:string|null,url:string|null,search:string}
+     */
+    protected function resourceRow(BaseModel $resource): array
+    {
+        $type = match (true) {
+            $resource instanceof Application => 'application',
+            $resource instanceof Service => 'service',
+            default => 'database',
+        };
+        $environment = $resource->environment;
+        $project = $environment?->project;
+        $routeName = "project.{$type}.configuration";
+        $url = ($project && $environment)
+            ? route($routeName, [
+                'project_uuid' => $project->uuid,
+                'environment_uuid' => $environment->uuid,
+                "{$type}_uuid" => $resource->uuid,
+            ])
+            : null;
+
+        return [
+            'uuid' => $resource->uuid,
+            'type' => $type,
+            'name' => $resource->name,
+            'project' => $project?->name,
+            'environment' => $environment?->name,
+            'url' => $url,
+            'search' => strtolower(implode(' ', array_filter([
+                $type,
+                $resource->name,
+                $project?->name,
+                $environment?->name,
+            ]))),
+        ];
+    }
+
+    public function render(): View
+    {
+        return view('livewire.destination.resources');
+    }
+}
diff --git a/app/Livewire/Project/Application/Advanced.php b/app/Livewire/Project/Application/Advanced.php
index 947368a0d..f62f8bfdd 100644
--- a/app/Livewire/Project/Application/Advanced.php
+++ b/app/Livewire/Project/Application/Advanced.php
@@ -87,6 +87,9 @@ class Advanced extends Component
     #[Validate(['boolean'])]
     public bool $isConnectToDockerNetworkEnabled = false;
 
+    #[Validate(['integer', 'min:0'])]
+    public int $maxRestartCount = 10;
+
     public function mount()
     {
         try {
@@ -149,6 +152,7 @@ public function syncData(bool $toModel = false)
             $this->disableBuildCache = $this->application->settings->disable_build_cache;
             $this->injectBuildArgsToDockerfile = $this->application->settings->inject_build_args_to_dockerfile ?? true;
             $this->includeSourceCommitInBuild = $this->application->settings->include_source_commit_in_build ?? false;
+            $this->maxRestartCount = $this->application->max_restart_count ?? 10;
         }
 
         // Load stop_grace_period separately since it has its own save handler
@@ -289,6 +293,21 @@ public function saveStopGracePeriod()
         }
     }
 
+    public function saveMaxRestartCount()
+    {
+        try {
+            $this->authorize('update', $this->application);
+            $this->validate([
+                'maxRestartCount' => 'integer|min:0',
+            ]);
+            $this->application->max_restart_count = $this->maxRestartCount;
+            $this->application->save();
+            $this->dispatch('success', 'Max restart count saved.');
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
+    }
+
     public function render()
     {
         return view('livewire.project.application.advanced');
diff --git a/app/Livewire/Project/Application/Configuration.php b/app/Livewire/Project/Application/Configuration.php
index 887fff35a..fb069f65b 100644
--- a/app/Livewire/Project/Application/Configuration.php
+++ b/app/Livewire/Project/Application/Configuration.php
@@ -28,7 +28,7 @@ public function mount()
 
         $project = currentTeam()
             ->projects()
-            ->select('id', 'uuid', 'team_id')
+            ->select('id', 'uuid', 'name', 'team_id')
             ->where('uuid', request()->route('project_uuid'))
             ->firstOrFail();
         $environment = $project->environments()
diff --git a/app/Livewire/Project/Application/General.php b/app/Livewire/Project/Application/General.php
index 0295aa5fc..89b1b4217 100644
--- a/app/Livewire/Project/Application/General.php
+++ b/app/Livewire/Project/Application/General.php
@@ -154,7 +154,7 @@ protected function rules(): array
             'staticImage' => 'required',
             'baseDirectory' => array_merge(['required'], array_slice(ValidationPatterns::directoryPathRules(), 1)),
             'publishDirectory' => ValidationPatterns::directoryPathRules(),
-            'portsExposes' => ['required', 'string', 'regex:/^(\d+)(,\d+)*$/'],
+            'portsExposes' => ['nullable', 'string', 'regex:/^(\d+)(,\d+)*$/'],
             'portsMappings' => ValidationPatterns::portMappingRules(),
             'customNetworkAliases' => 'nullable',
             'dockerfile' => 'nullable',
@@ -212,7 +212,6 @@ protected function messages(): array
                 'buildPack.required' => 'The Build Pack field is required.',
                 'staticImage.required' => 'The Static Image field is required.',
                 'baseDirectory.required' => 'The Base Directory field is required.',
-                'portsExposes.required' => 'The Exposed Ports field is required.',
                 'portsExposes.regex' => 'Ports exposes must be a comma-separated list of port numbers (e.g. 3000,3001).',
                 ...ValidationPatterns::portMappingMessages(),
                 'isStatic.required' => 'The Static setting is required.',
@@ -760,7 +759,7 @@ public function submit($showToaster = true)
 
             $this->resetErrorBag();
 
-            $this->portsExposes = str($this->portsExposes)->replace(' ', '')->trim()->toString();
+            $this->portsExposes = str($this->portsExposes)->replace(' ', '')->trim()->toString() ?: null;
             if ($this->portsMappings) {
                 $this->portsMappings = str($this->portsMappings)->replace(' ', '')->trim()->toString();
             }
diff --git a/app/Livewire/Project/Database/Configuration.php b/app/Livewire/Project/Database/Configuration.php
index 9f952ff2b..7f58a8421 100644
--- a/app/Livewire/Project/Database/Configuration.php
+++ b/app/Livewire/Project/Database/Configuration.php
@@ -26,7 +26,7 @@ public function mount()
 
             $project = currentTeam()
                 ->projects()
-                ->select('id', 'uuid', 'team_id')
+                ->select('id', 'uuid', 'name', 'team_id')
                 ->where('uuid', request()->route('project_uuid'))
                 ->firstOrFail();
             $environment = $project->environments()
diff --git a/app/Livewire/Project/New/Select.php b/app/Livewire/Project/New/Select.php
index 165e4b59e..d6d234b18 100644
--- a/app/Livewire/Project/New/Select.php
+++ b/app/Livewire/Project/New/Select.php
@@ -4,7 +4,9 @@
 
 use App\Models\Project;
 use App\Models\Server;
+use Carbon\CarbonImmutable;
 use Illuminate\Support\Collection;
+use Illuminate\Support\Facades\Cache;
 use Livewire\Component;
 
 class Select extends Component
@@ -105,7 +107,9 @@ public function updatedSelectedEnvironment()
     public function loadServices()
     {
         $services = get_service_templates();
-        $services = collect($services)->map(function ($service, $key) {
+        $templateLastUpdatedMap = $this->serviceTemplateLastUpdatedMap($services->keys());
+
+        $services = collect($services)->map(function ($service, $key) use ($templateLastUpdatedMap) {
             $default_logo = 'images/default.webp';
             $logo = data_get($service, 'logo', $default_logo);
             $local_logo_path = public_path($logo);
@@ -116,6 +120,7 @@ public function loadServices()
                 'logo_github_url' => file_exists($local_logo_path)
                     ? 'https://raw.githubusercontent.com/coollabsio/coolify/refs/heads/main/public/'.$logo
                     : asset($default_logo),
+                'templateLastUpdated' => $templateLastUpdatedMap[(string) $key] ?? null,
             ] + (array) $service;
         })->all();
 
@@ -247,6 +252,7 @@ public function loadServices()
         ];
 
         return [
+            'serviceTemplatesLastUpdated' => $this->serviceTemplatesLastUpdated(),
             'services' => $services,
             'categories' => $categories,
             'gitBasedApplications' => $gitBasedApplications,
@@ -268,6 +274,55 @@ public function instantSave()
         }
     }
 
+    private function serviceTemplatesLastUpdated(): ?string
+    {
+        return $this->formatLastModified($this->serviceTemplatesPath());
+    }
+
+    private function serviceTemplateLastUpdatedMap(Collection $serviceNames): array
+    {
+        $bundleMtime = file_exists($this->serviceTemplatesPath()) ? filemtime($this->serviceTemplatesPath()) : 0;
+
+        return Cache::remember(
+            "service-template-last-updated-map:{$bundleMtime}",
+            now()->addDay(),
+            fn () => $serviceNames
+                ->mapWithKeys(fn ($serviceName) => [
+                    (string) $serviceName => $this->serviceTemplateLastUpdated((string) $serviceName),
+                ])
+                ->all()
+        );
+    }
+
+    private function serviceTemplateLastUpdated(string $serviceName): ?string
+    {
+        foreach (['yaml', 'yml'] as $extension) {
+            $templatePath = base_path("templates/compose/{$serviceName}.{$extension}");
+
+            if (file_exists($templatePath)) {
+                return $this->formatLastModified($templatePath);
+            }
+        }
+
+        return null;
+    }
+
+    private function serviceTemplatesPath(): string
+    {
+        return base_path('templates/'.config('constants.services.file_name'));
+    }
+
+    private function formatLastModified(string $path): ?string
+    {
+        if (! file_exists($path)) {
+            return null;
+        }
+
+        return CarbonImmutable::createFromTimestamp(filemtime($path))
+            ->timezone(config('app.timezone'))
+            ->format('M j, Y H:i');
+    }
+
     public function setType(string $type)
     {
         $type = str($type)->lower()->slug()->value();
diff --git a/app/Livewire/Project/Service/Configuration.php b/app/Livewire/Project/Service/Configuration.php
index ac2b39bb8..caa19042b 100644
--- a/app/Livewire/Project/Service/Configuration.php
+++ b/app/Livewire/Project/Service/Configuration.php
@@ -44,7 +44,7 @@ public function mount()
             $this->query = request()->query();
             $project = currentTeam()
                 ->projects()
-                ->select('id', 'uuid', 'team_id')
+                ->select('id', 'uuid', 'name', 'team_id')
                 ->where('uuid', request()->route('project_uuid'))
                 ->firstOrFail();
             $environment = $project->environments()
diff --git a/app/Livewire/Project/Shared/ConfigurationChecker.php b/app/Livewire/Project/Shared/ConfigurationChecker.php
index d583e74e6..43bf3140b 100644
--- a/app/Livewire/Project/Shared/ConfigurationChecker.php
+++ b/app/Livewire/Project/Shared/ConfigurationChecker.php
@@ -21,8 +21,6 @@ class ConfigurationChecker extends Component
 
     public array $configurationDiff = [];
 
-    public array $groupedConfigurationChanges = [];
-
     public Application|Service|StandaloneRedis|StandalonePostgresql|StandaloneMongodb|StandaloneMysql|StandaloneMariadb|StandaloneKeydb|StandaloneDragonfly|StandaloneClickhouse $resource;
 
     public function getListeners(): array
@@ -50,21 +48,56 @@ public function refreshConfigurationChanges(): void
         $this->configurationChanged();
     }
 
+    /**
+     * Members must never see environment variable values, so redact every
+     * environment-section change before it is serialized to the browser.
+     *
+     * @param  array<int, array<string, mixed>>  $changes
+     * @return array<int, array<string, mixed>>
+     */
+    private function redactEnvironmentChanges(array $changes, bool $redact): array
+    {
+        if (! $redact) {
+            return $changes;
+        }
+
+        return collect($changes)
+            ->map(function (array $change): array {
+                if (data_get($change, 'section') !== 'environment') {
+                    return $change;
+                }
+
+                $change['old_display_value'] = data_get($change, 'old_display_value') === '-' ? '-' : '••••••••';
+                $change['new_display_value'] = data_get($change, 'new_display_value') === '-' ? '-' : '••••••••';
+                $change['old_full_value'] = null;
+                $change['new_full_value'] = null;
+                $change['expandable'] = false;
+                $change['display_summary'] = data_get($change, 'type') === 'changed' ? 'Changed' : null;
+
+                return $change;
+            })
+            ->all();
+    }
+
     public function configurationChanged(): void
     {
         $this->resource->refresh();
 
         if ($this->resource instanceof Application) {
             $diff = $this->resource->pendingDeploymentConfigurationDiff();
+            // Fail closed: only owners/admins may see unlocked env values.
+            $redactEnvironment = ! (bool) auth()->user()?->isAdmin();
+
+            $array = $diff->toArray();
+            $array['changes'] = $this->redactEnvironmentChanges($array['changes'] ?? [], $redactEnvironment);
+
             $this->isConfigurationChanged = $diff->isChanged();
-            $this->configurationDiff = $diff->toArray();
-            $this->groupedConfigurationChanges = $diff->groupedChanges();
+            $this->configurationDiff = $array;
 
             return;
         }
 
         $this->isConfigurationChanged = $this->resource->isConfigurationChanged();
         $this->configurationDiff = [];
-        $this->groupedConfigurationChanges = [];
     }
 }
diff --git a/app/Livewire/Project/Shared/EnvironmentVariable/All.php b/app/Livewire/Project/Shared/EnvironmentVariable/All.php
index f5f0f32e6..3a5145023 100644
--- a/app/Livewire/Project/Shared/EnvironmentVariable/All.php
+++ b/app/Livewire/Project/Shared/EnvironmentVariable/All.php
@@ -7,6 +7,8 @@
 use App\Support\ValidationPatterns;
 use App\Traits\EnvironmentVariableProtection;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Illuminate\Support\Collection;
+use Illuminate\Support\Str;
 use Livewire\Component;
 
 class All extends Component
@@ -25,6 +27,8 @@ class All extends Component
 
     public string $view = 'normal';
 
+    public string $search = '';
+
     public bool $is_env_sorting_enabled = false;
 
     public bool $use_build_secrets = false;
@@ -35,6 +39,20 @@ class All extends Component
         'environmentVariableDeleted' => 'refreshEnvs',
     ];
 
+    public function updatedSearch(): void
+    {
+        $this->clearEnvironmentVariableCaches();
+    }
+
+    private function clearEnvironmentVariableCaches(): void
+    {
+        unset($this->environmentVariables);
+        unset($this->environmentVariablesPreview);
+        unset($this->hardcodedEnvironmentVariables);
+        unset($this->hardcodedEnvironmentVariablesPreview);
+        unset($this->hasEnvironmentVariables);
+    }
+
     public function mount()
     {
         $this->is_env_sorting_enabled = data_get($this->resource, 'settings.is_env_sorting_enabled', false);
@@ -65,8 +83,27 @@ public function instantSave()
 
     public function getEnvironmentVariablesProperty()
     {
-        $query = $this->resource->environment_variables()
-            ->orderByRaw("CASE WHEN is_required = true AND (value IS NULL OR value = '') THEN 0 ELSE 1 END");
+        return $this->getEnvironmentVariables(false);
+    }
+
+    public function getEnvironmentVariablesPreviewProperty()
+    {
+        return $this->getEnvironmentVariables(true);
+    }
+
+    private function getEnvironmentVariables(bool $isPreview, bool $withSearch = true): Collection
+    {
+        $query = $isPreview
+            ? $this->resource->environment_variables_preview()
+            : $this->resource->environment_variables();
+
+        $query->orderByRaw("CASE WHEN is_required = true AND (value IS NULL OR value = '') THEN 0 ELSE 1 END");
+
+        if ($withSearch && $this->searchTerm() !== '') {
+            $escapedSearch = addcslashes(Str::lower($this->searchTerm()), '%_\\');
+
+            $query->whereRaw("LOWER(key) LIKE ? ESCAPE '\\'", ['%'.$escapedSearch.'%']);
+        }
 
         if ($this->is_env_sorting_enabled) {
             $query->orderBy('key');
@@ -77,18 +114,17 @@ public function getEnvironmentVariablesProperty()
         return $this->nullLockedValues($query->get());
     }
 
-    public function getEnvironmentVariablesPreviewProperty()
+    private function searchTerm(): string
     {
-        $query = $this->resource->environment_variables_preview()
-            ->orderByRaw("CASE WHEN is_required = true AND (value IS NULL OR value = '') THEN 0 ELSE 1 END");
+        return trim($this->search);
+    }
 
-        if ($this->is_env_sorting_enabled) {
-            $query->orderBy('key');
-        } else {
-            $query->orderBy('order');
-        }
-
-        return $this->nullLockedValues($query->get());
+    public function getHasEnvironmentVariablesProperty(): bool
+    {
+        return $this->environmentVariables->isNotEmpty() ||
+            $this->environmentVariablesPreview->isNotEmpty() ||
+            $this->hardcodedEnvironmentVariables->isNotEmpty() ||
+            $this->hardcodedEnvironmentVariablesPreview->isNotEmpty();
     }
 
     private function nullLockedValues($envs)
@@ -105,6 +141,11 @@ private function nullLockedValues($envs)
         return $envs;
     }
 
+    public function getIsSearchActiveProperty(): bool
+    {
+        return $this->searchTerm() !== '';
+    }
+
     public function getHardcodedEnvironmentVariablesProperty()
     {
         return $this->getHardcodedVariables(false);
@@ -152,6 +193,12 @@ protected function getHardcodedVariables(bool $isPreview)
             return ! in_array($var['key'], $managedKeys);
         });
 
+        if ($this->searchTerm() !== '') {
+            $hardcodedVars = $hardcodedVars->filter(function ($var) {
+                return str($var['key'])->contains($this->searchTerm(), true);
+            });
+        }
+
         // Apply sorting based on is_env_sorting_enabled
         if ($this->is_env_sorting_enabled) {
             $hardcodedVars = $hardcodedVars->sortBy('key')->values();
@@ -163,9 +210,9 @@ protected function getHardcodedVariables(bool $isPreview)
 
     public function getDevView()
     {
-        $this->variables = $this->formatEnvironmentVariables($this->environmentVariables);
+        $this->variables = $this->formatEnvironmentVariables($this->getEnvironmentVariables(false, false));
         if ($this->showPreview) {
-            $this->variablesPreview = $this->formatEnvironmentVariables($this->environmentVariablesPreview);
+            $this->variablesPreview = $this->formatEnvironmentVariables($this->getEnvironmentVariables(true, false));
         }
     }
 
@@ -301,9 +348,7 @@ private function handleSingleSubmit($data)
         $environment->order = $maxOrder + 1;
         $environment->save();
 
-        // Clear computed property cache to force refresh
-        unset($this->environmentVariables);
-        unset($this->environmentVariablesPreview);
+        $this->clearEnvironmentVariableCaches();
 
         $this->dispatch('success', 'Environment variable added.');
     }
@@ -432,9 +477,7 @@ private function updateOrCreateVariables($isPreview, $variables)
     public function refreshEnvs()
     {
         $this->resource->refresh();
-        // Clear computed property cache to force refresh
-        unset($this->environmentVariables);
-        unset($this->environmentVariablesPreview);
+        $this->clearEnvironmentVariableCaches();
         $this->getDevView();
     }
 }
diff --git a/app/Livewire/Project/Shared/ResourceDetails.php b/app/Livewire/Project/Shared/ResourceDetails.php
new file mode 100644
index 000000000..8a4117c39
--- /dev/null
+++ b/app/Livewire/Project/Shared/ResourceDetails.php
@@ -0,0 +1,91 @@
+<?php
+
+namespace App\Livewire\Project\Shared;
+
+use App\Models\Service;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Livewire\Component;
+
+class ResourceDetails extends Component
+{
+    use AuthorizesRequests;
+
+    public $resource;
+
+    public ?string $project_uuid = null;
+
+    public ?string $project_name = null;
+
+    public ?string $environment_uuid = null;
+
+    public ?string $environment_name = null;
+
+    public ?string $server_uuid = null;
+
+    public ?string $server_name = null;
+
+    public array $stack_applications = [];
+
+    public array $stack_databases = [];
+
+    public function mount()
+    {
+        $this->authorize('view', $this->resource);
+
+        $environment = $this->resource->environment ?? null;
+        if ($environment) {
+            $this->environment_uuid = $environment->uuid;
+            $this->environment_name = $environment->name;
+            $project = $environment->project ?? null;
+            if ($project) {
+                $this->project_uuid = $project->uuid;
+                $this->project_name = $project->name;
+            }
+        }
+
+        $server = $this->resolveServer();
+        if ($server) {
+            $this->server_uuid = $server->uuid;
+            $this->server_name = $server->name;
+        }
+
+        if ($this->resource instanceof Service) {
+            $this->stack_applications = $this->resource->applications
+                ->map(fn ($app) => [
+                    'name' => $app->human_name ?: $app->name,
+                    'uuid' => $app->uuid,
+                ])
+                ->values()
+                ->all();
+
+            $this->stack_databases = $this->resource->databases
+                ->map(fn ($db) => [
+                    'name' => $db->human_name ?: $db->name,
+                    'uuid' => $db->uuid,
+                ])
+                ->values()
+                ->all();
+        }
+    }
+
+    private function resolveServer()
+    {
+        try {
+            if (isset($this->resource->destination) && $this->resource->destination && isset($this->resource->destination->server)) {
+                return $this->resource->destination->server;
+            }
+            if (method_exists($this->resource, 'server') && $this->resource->server) {
+                return $this->resource->server;
+            }
+        } catch (\Throwable $e) {
+            return null;
+        }
+
+        return null;
+    }
+
+    public function render()
+    {
+        return view('livewire.project.shared.resource-details');
+    }
+}
diff --git a/app/Livewire/Server/Charts.php b/app/Livewire/Server/Charts.php
index d0db87f57..1cda771a7 100644
--- a/app/Livewire/Server/Charts.php
+++ b/app/Livewire/Server/Charts.php
@@ -2,11 +2,15 @@
 
 namespace App\Livewire\Server;
 
+use App\Actions\Server\StartSentinel;
 use App\Models\Server;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
 
 class Charts extends Component
 {
+    use AuthorizesRequests;
+
     public Server $server;
 
     public $chartId = 'server';
@@ -28,6 +32,29 @@ public function mount(string $server_uuid)
         }
     }
 
+    public function toggleMetrics(): void
+    {
+        try {
+            $this->authorize('update', $this->server);
+            $this->server->settings->is_metrics_enabled = ! $this->server->settings->is_metrics_enabled;
+            $this->server->settings->save();
+            $this->server->refresh();
+
+            if ($this->server->isMetricsEnabled()) {
+                StartSentinel::run($this->server, true);
+                $this->dispatch('success', 'Metrics enabled. Starting Sentinel.');
+                $this->dispatch('refreshServerShow');
+                $this->redirect(route('server.metrics', ['server_uuid' => $this->server->uuid]), navigate: true);
+            } else {
+                $this->server->restartSentinel();
+                $this->dispatch('success', 'Metrics disabled. Restarting Sentinel.');
+                $this->dispatch('refreshServerShow');
+            }
+        } catch (\Throwable $e) {
+            handleError($e, $this);
+        }
+    }
+
     public function pollData()
     {
         if ($this->poll || $this->interval <= 10) {
diff --git a/app/Livewire/Server/New/ByIp.php b/app/Livewire/Server/New/ByIp.php
index 51c6a06ee..f5ea2ae80 100644
--- a/app/Livewire/Server/New/ByIp.php
+++ b/app/Livewire/Server/New/ByIp.php
@@ -57,7 +57,7 @@ protected function rules(): array
             'name' => ValidationPatterns::nameRules(),
             'description' => ValidationPatterns::descriptionRules(),
             'ip' => ['required', 'string', new ValidServerIp],
-            'user' => ['required', 'string', 'regex:/^[a-zA-Z0-9_-]+$/'],
+            'user' => ValidationPatterns::serverUsernameRules(),
             'port' => 'required|integer|between:1,65535',
             'is_build_server' => 'required|boolean',
         ];
@@ -75,6 +75,7 @@ protected function messages(): array
             'ip.string' => 'The IP Address/Domain must be a string.',
             'user.required' => 'The User field is required.',
             'user.string' => 'The User field must be a string.',
+            ...ValidationPatterns::serverUsernameMessages(),
             'port.required' => 'The Port field is required.',
             'port.integer' => 'The Port field must be an integer.',
             'port.between' => 'The Port field must be between 1 and 65535.',
diff --git a/app/Livewire/Server/Sentinel.php b/app/Livewire/Server/Sentinel.php
index 06aebd8f8..909ed54f9 100644
--- a/app/Livewire/Server/Sentinel.php
+++ b/app/Livewire/Server/Sentinel.php
@@ -15,8 +15,6 @@ class Sentinel extends Component
 
     public Server $server;
 
-    public array $parameters = [];
-
     public bool $isMetricsEnabled;
 
     #[Validate(['required', 'string', 'max:500', 'regex:/\A[a-zA-Z0-9._\-+=\/]+\z/'])]
@@ -51,15 +49,9 @@ public function getListeners()
         ];
     }
 
-    public function mount(string $server_uuid)
+    public function mount()
     {
-        try {
-            $this->server = Server::ownedByCurrentTeam()->whereUuid($server_uuid)->firstOrFail();
-            $this->parameters = get_route_parameters();
-            $this->syncData();
-        } catch (\Throwable) {
-            return redirect()->route('server.index');
-        }
+        $this->syncData();
     }
 
     public function syncData(bool $toModel = false)
@@ -112,27 +104,29 @@ public function restartSentinel()
         }
     }
 
-    public function updatedIsSentinelEnabled($value)
+    public function toggleSentinel(): void
     {
         try {
             $this->authorize('manageSentinel', $this->server);
-            if ($value === true) {
+            if (! $this->isSentinelEnabled) {
                 if ($this->server->isBuildServer()) {
-                    $this->isSentinelEnabled = false;
                     $this->dispatch('error', 'Sentinel cannot be enabled on build servers.');
 
                     return;
                 }
+                $this->isSentinelEnabled = true;
                 $customImage = isDev() ? $this->sentinelCustomDockerImage : null;
                 StartSentinel::run($this->server, true, null, $customImage);
             } else {
+                $this->isSentinelEnabled = false;
                 $this->isMetricsEnabled = false;
                 $this->isSentinelDebugEnabled = false;
                 StopSentinel::dispatch($this->server);
             }
             $this->submit();
+            $this->dispatch('refreshServerShow');
         } catch (\Throwable $e) {
-            return handleError($e, $this);
+            handleError($e, $this);
         }
     }
 
diff --git a/app/Livewire/Server/Sentinel/Logs.php b/app/Livewire/Server/Sentinel/Logs.php
new file mode 100644
index 000000000..6619e101e
--- /dev/null
+++ b/app/Livewire/Server/Sentinel/Logs.php
@@ -0,0 +1,29 @@
+<?php
+
+namespace App\Livewire\Server\Sentinel;
+
+use App\Models\Server;
+use Illuminate\View\View;
+use Livewire\Component;
+
+class Logs extends Component
+{
+    public ?Server $server = null;
+
+    public array $parameters = [];
+
+    public function mount(): void
+    {
+        $this->parameters = get_route_parameters();
+        try {
+            $this->server = Server::ownedByCurrentTeam()->whereUuid(request()->server_uuid)->firstOrFail();
+        } catch (\Throwable $e) {
+            handleError($e, $this);
+        }
+    }
+
+    public function render(): View
+    {
+        return view('livewire.server.sentinel.logs');
+    }
+}
diff --git a/app/Livewire/Server/Sentinel/Show.php b/app/Livewire/Server/Sentinel/Show.php
new file mode 100644
index 000000000..7070a09ce
--- /dev/null
+++ b/app/Livewire/Server/Sentinel/Show.php
@@ -0,0 +1,29 @@
+<?php
+
+namespace App\Livewire\Server\Sentinel;
+
+use App\Models\Server;
+use Illuminate\View\View;
+use Livewire\Component;
+
+class Show extends Component
+{
+    public ?Server $server = null;
+
+    public array $parameters = [];
+
+    public function mount(): void
+    {
+        $this->parameters = get_route_parameters();
+        try {
+            $this->server = Server::ownedByCurrentTeam()->whereUuid(request()->server_uuid)->firstOrFail();
+        } catch (\Throwable $e) {
+            handleError($e, $this);
+        }
+    }
+
+    public function render(): View
+    {
+        return view('livewire.server.sentinel.show');
+    }
+}
diff --git a/app/Livewire/Server/Show.php b/app/Livewire/Server/Show.php
index dc6a775a0..d14046ed1 100644
--- a/app/Livewire/Server/Show.php
+++ b/app/Livewire/Server/Show.php
@@ -110,7 +110,7 @@ protected function rules(): array
             'name' => ValidationPatterns::nameRules(),
             'description' => ValidationPatterns::descriptionRules(),
             'ip' => ['required', new ValidServerIp],
-            'user' => ['required', 'regex:/^[a-zA-Z0-9_-]+$/'],
+            'user' => ValidationPatterns::serverUsernameRules(),
             'port' => 'required|integer|between:1,65535',
             'connectionTimeout' => 'required|integer|min:1|max:300',
             'validationLogs' => 'nullable',
@@ -140,6 +140,7 @@ protected function messages(): array
             [
                 'ip.required' => 'The IP Address field is required.',
                 'user.required' => 'The User field is required.',
+                ...ValidationPatterns::serverUsernameMessages(),
                 'port.required' => 'The Port field is required.',
                 'connectionTimeout.required' => 'The SSH Connection Timeout field is required.',
                 'connectionTimeout.integer' => 'The SSH Connection Timeout must be an integer.',
diff --git a/app/Livewire/Settings/ScheduledJobs.php b/app/Livewire/Settings/ScheduledJobs.php
index 1e54f1483..3655329b1 100644
--- a/app/Livewire/Settings/ScheduledJobs.php
+++ b/app/Livewire/Settings/ScheduledJobs.php
@@ -8,6 +8,15 @@
 use App\Models\ScheduledTask;
 use App\Models\ScheduledTaskExecution;
 use App\Models\Server;
+use App\Models\ServiceDatabase;
+use App\Models\StandaloneClickhouse;
+use App\Models\StandaloneDragonfly;
+use App\Models\StandaloneKeydb;
+use App\Models\StandaloneMariadb;
+use App\Models\StandaloneMongodb;
+use App\Models\StandaloneMysql;
+use App\Models\StandalonePostgresql;
+use App\Models\StandaloneRedis;
 use App\Services\SchedulerLogParser;
 use Illuminate\Support\Carbon;
 use Illuminate\Support\Collection;
@@ -125,7 +134,21 @@ private function enrichSkipLogsWithLinks(Collection $skipLogs): Collection
             : collect();
 
         $backups = $backupIds->isNotEmpty()
-            ? ScheduledDatabaseBackup::with(['database.environment.project'])->whereIn('id', $backupIds)->get()->keyBy('id')
+            ? ScheduledDatabaseBackup::with('database')
+                ->whereIn('id', $backupIds)
+                ->get()
+                ->loadMorph('database', [
+                    ServiceDatabase::class => ['service.environment.project'],
+                    StandaloneClickhouse::class => ['environment.project'],
+                    StandaloneDragonfly::class => ['environment.project'],
+                    StandaloneKeydb::class => ['environment.project'],
+                    StandaloneMariadb::class => ['environment.project'],
+                    StandaloneMongodb::class => ['environment.project'],
+                    StandaloneMysql::class => ['environment.project'],
+                    StandalonePostgresql::class => ['environment.project'],
+                    StandaloneRedis::class => ['environment.project'],
+                ])
+                ->keyBy('id')
             : collect();
 
         $servers = $serverIds->isNotEmpty()
@@ -161,14 +184,29 @@ private function enrichSkipLogsWithLinks(Collection $skipLogs): Collection
                 if ($backup) {
                     $database = $backup->database;
                     $skip['resource_name'] = $database?->name ?? 'Database backup';
-                    $environment = $database?->environment;
-                    $project = $environment?->project;
-                    if ($project && $environment && $database) {
-                        $skip['link'] = route('project.database.backup.index', [
-                            'project_uuid' => $project->uuid,
-                            'environment_uuid' => $environment->uuid,
-                            'database_uuid' => $database->uuid,
-                        ]);
+
+                    if ($database instanceof ServiceDatabase) {
+                        $service = $database->service;
+                        $environment = $service?->environment;
+                        $project = $environment?->project;
+                        if ($project && $environment && $service) {
+                            $skip['link'] = route('project.service.database.backups', [
+                                'project_uuid' => $project->uuid,
+                                'environment_uuid' => $environment->uuid,
+                                'service_uuid' => $service->uuid,
+                                'stack_service_uuid' => $database->uuid,
+                            ]);
+                        }
+                    } else {
+                        $environment = $database?->environment;
+                        $project = $environment?->project;
+                        if ($project && $environment && $database) {
+                            $skip['link'] = route('project.database.backup.index', [
+                                'project_uuid' => $project->uuid,
+                                'environment_uuid' => $environment->uuid,
+                                'database_uuid' => $database->uuid,
+                            ]);
+                        }
                     }
                 }
             } elseif ($skip['type'] === 'docker_cleanup') {
diff --git a/app/Livewire/Source/Github/Change.php b/app/Livewire/Source/Github/Change.php
index 1470b95db..648bfe6ee 100644
--- a/app/Livewire/Source/Github/Change.php
+++ b/app/Livewire/Source/Github/Change.php
@@ -210,6 +210,9 @@ public function checkPermissions()
 
             GithubAppPermissionJob::dispatchSync($this->github_app);
             $this->github_app->refresh()->makeVisible('client_secret')->makeVisible('webhook_secret');
+            $this->syncData(false);
+            $this->name = str($this->github_app->name)->kebab();
+
             $this->dispatch('success', 'Github App permissions updated.');
         } catch (\Throwable $e) {
             // Provide better error message for unsupported key formats
diff --git a/app/Livewire/Team/InviteLink.php b/app/Livewire/Team/InviteLink.php
index ee6d535e9..fb30961e9 100644
--- a/app/Livewire/Team/InviteLink.php
+++ b/app/Livewire/Team/InviteLink.php
@@ -61,7 +61,7 @@ private function generateInviteLink(bool $sendEmail = false)
             if ($member_emails->contains($this->email)) {
                 return handleError(livewire: $this, customErrorMessage: "$this->email is already a member of ".currentTeam()->name.'.');
             }
-            $uuid = new Cuid2(32);
+            $uuid = (string) new Cuid2(32);
             $link = url('/').config('constants.invitation.link.base_url').$uuid;
             $user = User::whereEmail($this->email)->first();
 
@@ -73,7 +73,7 @@ private function generateInviteLink(bool $sendEmail = false)
                     'password' => Hash::make($password),
                     'force_password_reset' => true,
                 ]);
-                $token = Crypt::encryptString("{$user->email}@@@$password");
+                $token = Crypt::encryptString("{$user->email}@@@{$uuid}@@@{$password}");
                 $link = route('auth.link', ['token' => $token]);
             }
             $invitation = TeamInvitation::whereEmail($this->email)->first();
diff --git a/app/Models/Application.php b/app/Models/Application.php
index 3905281d8..b2f852f15 100644
--- a/app/Models/Application.php
+++ b/app/Models/Application.php
@@ -204,6 +204,7 @@ class Application extends BaseModel
         'config_hash',
         'last_online_at',
         'restart_count',
+        'max_restart_count',
         'last_restart_at',
         'last_restart_type',
         'uuid',
@@ -227,6 +228,7 @@ protected function casts(): array
             'manual_webhook_secret_bitbucket' => 'encrypted',
             'manual_webhook_secret_gitea' => 'encrypted',
             'restart_count' => 'integer',
+            'max_restart_count' => 'integer',
             'last_restart_at' => 'datetime',
         ];
     }
@@ -570,6 +572,15 @@ public function link()
         return null;
     }
 
+    public function stoppedAfterRestartLimit(): bool
+    {
+        return str($this->status)->startsWith('exited')
+            && ($this->restart_count ?? 0) > 0
+            && ($this->max_restart_count ?? 0) > 0
+            && $this->restart_count >= $this->max_restart_count
+            && $this->last_restart_type === 'crash';
+    }
+
     public function taskLink($task_uuid)
     {
         if (data_get($this, 'environment.project.uuid')) {
@@ -1347,6 +1358,7 @@ public function generateGitLsRemoteCommands(string $deployment_uuid, bool $exec_
         $branch = $this->git_branch;
         ['repository' => $customRepository, 'port' => $customPort] = $this->customRepository();
         $commands = collect([]);
+        $customSshKeyLocation = "/root/.ssh/id_rsa_coolify_{$deployment_uuid}";
         $base_command = 'git ls-remote';
 
         if ($this->deploymentType() === 'source') {
@@ -1400,19 +1412,20 @@ public function generateGitLsRemoteCommands(string $deployment_uuid, bool $exec_
                     $private_key = base64_encode($private_key);
                     $gitlabPort = $gitlabSource->custom_port ?? 22;
                     $escapedCustomRepository = str_replace("'", "'\\''", $customRepository);
-                    $base_command = "GIT_SSH_COMMAND=\"ssh -o ConnectTimeout=30 -p {$gitlabPort} -o Port={$gitlabPort} -o LogLevel=ERROR -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i /root/.ssh/id_rsa\" {$base_command} '{$escapedCustomRepository}'";
+                    $base_command = "GIT_SSH_COMMAND=\"ssh -o ConnectTimeout=30 -p {$gitlabPort} -o Port={$gitlabPort} -o LogLevel=ERROR -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i {$customSshKeyLocation} -o IdentitiesOnly=yes\" {$base_command} '{$escapedCustomRepository}'";
 
                     if ($exec_in_docker) {
                         $commands = collect([
                             executeInDocker($deployment_uuid, 'mkdir -p /root/.ssh'),
-                            executeInDocker($deployment_uuid, "echo '{$private_key}' | base64 -d | tee /root/.ssh/id_rsa > /dev/null"),
-                            executeInDocker($deployment_uuid, 'chmod 600 /root/.ssh/id_rsa'),
+                            executeInDocker($deployment_uuid, "echo '{$private_key}' | base64 -d | tee {$customSshKeyLocation} > /dev/null"),
+                            executeInDocker($deployment_uuid, "chmod 600 {$customSshKeyLocation}"),
                         ]);
                     } else {
                         $commands = collect([
+                            "trap 'rm -f {$customSshKeyLocation}' EXIT",
                             'mkdir -p /root/.ssh',
-                            "echo '{$private_key}' | base64 -d | tee /root/.ssh/id_rsa > /dev/null",
-                            'chmod 600 /root/.ssh/id_rsa',
+                            "echo '{$private_key}' | base64 -d | tee {$customSshKeyLocation} > /dev/null",
+                            "chmod 600 {$customSshKeyLocation}",
                         ]);
                     }
 
@@ -1458,19 +1471,20 @@ public function generateGitLsRemoteCommands(string $deployment_uuid, bool $exec_
             // When used with executeInDocker (which uses bash -c '...'), we need to escape for bash context
             // Replace ' with '\'' to safely escape within single-quoted bash strings
             $escapedCustomRepository = str_replace("'", "'\\''", $customRepository);
-            $base_command = "GIT_SSH_COMMAND=\"ssh -o ConnectTimeout=30 -p {$customPort} -o Port={$customPort} -o LogLevel=ERROR -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i /root/.ssh/id_rsa\" {$base_command} '{$escapedCustomRepository}'";
+            $base_command = "GIT_SSH_COMMAND=\"ssh -o ConnectTimeout=30 -p {$customPort} -o Port={$customPort} -o LogLevel=ERROR -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i {$customSshKeyLocation} -o IdentitiesOnly=yes\" {$base_command} '{$escapedCustomRepository}'";
 
             if ($exec_in_docker) {
                 $commands = collect([
                     executeInDocker($deployment_uuid, 'mkdir -p /root/.ssh'),
-                    executeInDocker($deployment_uuid, "echo '{$private_key}' | base64 -d | tee /root/.ssh/id_rsa > /dev/null"),
-                    executeInDocker($deployment_uuid, 'chmod 600 /root/.ssh/id_rsa'),
+                    executeInDocker($deployment_uuid, "echo '{$private_key}' | base64 -d | tee {$customSshKeyLocation} > /dev/null"),
+                    executeInDocker($deployment_uuid, "chmod 600 {$customSshKeyLocation}"),
                 ]);
             } else {
                 $commands = collect([
+                    "trap 'rm -f {$customSshKeyLocation}' EXIT",
                     'mkdir -p /root/.ssh',
-                    "echo '{$private_key}' | base64 -d | tee /root/.ssh/id_rsa > /dev/null",
-                    'chmod 600 /root/.ssh/id_rsa',
+                    "echo '{$private_key}' | base64 -d | tee {$customSshKeyLocation} > /dev/null",
+                    "chmod 600 {$customSshKeyLocation}",
                 ]);
             }
 
@@ -1506,11 +1520,34 @@ public function generateGitLsRemoteCommands(string $deployment_uuid, bool $exec_
         }
     }
 
+    private function withGitHttpTransportConfig(?string $gitConfigOptions = null): string
+    {
+        return trim(($gitConfigOptions ? "{$gitConfigOptions} " : '').'-c http.version=HTTP/1.1');
+    }
+
+    private function isHttpGitRepository(string $repository): bool
+    {
+        return str_starts_with($repository, 'https://') || str_starts_with($repository, 'http://');
+    }
+
+    private function applyGitConfigOptionsToCloneCommand(string $gitCloneCommand, string $gitConfigOptions): string
+    {
+        $configuredCommand = preg_replace(
+            "/^git(?:\s+-c\s+(?:'[^']*'|\S+))*\s+clone\b/",
+            "git {$gitConfigOptions} clone",
+            $gitCloneCommand,
+            1
+        );
+
+        return $configuredCommand ?: $gitCloneCommand;
+    }
+
     public function generateGitImportCommands(string $deployment_uuid, int $pull_request_id = 0, ?string $git_type = null, bool $exec_in_docker = true, bool $only_checkout = false, ?string $custom_base_dir = null, ?string $commit = null)
     {
         $branch = $this->git_branch;
         ['repository' => $customRepository, 'port' => $customPort] = $this->customRepository();
         $baseDir = $custom_base_dir ?? $this->generateBaseDir($deployment_uuid);
+        $customSshKeyLocation = "/root/.ssh/id_rsa_coolify_{$deployment_uuid}";
 
         // Escape shell arguments for safety to prevent command injection
         $escapedBranch = escapeshellarg($branch);
@@ -1548,8 +1585,10 @@ public function generateGitImportCommands(string $deployment_uuid, int $pull_req
                     $fullRepoUrl = "{$this->source->html_url}/{$customRepository}";
                     $escapedRepoUrl = escapeshellarg("{$this->source->html_url}/{$customRepository}");
                     $git_clone_command = "{$git_clone_command} {$escapedRepoUrl} {$escapedBaseDir}";
+                    $gitConfigOptions = $this->withGitHttpTransportConfig();
+                    $git_clone_command = $this->applyGitConfigOptionsToCloneCommand($git_clone_command, $gitConfigOptions);
                     if (! $only_checkout) {
-                        $git_clone_command = $this->setGitImportSettings($deployment_uuid, $git_clone_command, public: true, commit: $commit);
+                        $git_clone_command = $this->setGitImportSettings($deployment_uuid, $git_clone_command, public: true, commit: $commit, gitConfigOptions: $gitConfigOptions);
                     }
                     if ($exec_in_docker) {
                         $commands->push(executeInDocker($deployment_uuid, $git_clone_command));
@@ -1562,6 +1601,7 @@ public function generateGitImportCommands(string $deployment_uuid, int $pull_req
 
                     // Rewrite same-host HTTPS URLs only for these git commands so submodules can authenticate without persisting credentials.
                     $gitConfigOption = '-c '.escapeshellarg("url.{$source_html_url_scheme}://x-access-token:{$encodedToken}@{$source_html_url_host}/.insteadOf={$source_html_url_scheme}://{$source_html_url_host}/");
+                    $gitConfigOptions = $this->withGitHttpTransportConfig($gitConfigOption);
                     $git_clone_command = str_replace('git clone', "git {$gitConfigOption} clone", $git_clone_command);
 
                     if ($exec_in_docker) {
@@ -1575,8 +1615,9 @@ public function generateGitImportCommands(string $deployment_uuid, int $pull_req
                         $git_clone_command = "{$git_clone_command} {$escapedRepoUrl} {$escapedBaseDir}";
                         $fullRepoUrl = $repoUrl;
                     }
+                    $git_clone_command = $this->applyGitConfigOptionsToCloneCommand($git_clone_command, $gitConfigOptions);
                     if (! $only_checkout) {
-                        $git_clone_command = $this->setGitImportSettings($deployment_uuid, $git_clone_command, public: false, commit: $commit, gitConfigOptions: $gitConfigOption);
+                        $git_clone_command = $this->setGitImportSettings($deployment_uuid, $git_clone_command, public: false, commit: $commit, gitConfigOptions: $gitConfigOptions);
                     }
                     if ($exec_in_docker) {
                         $commands->push(executeInDocker($deployment_uuid, $git_clone_command));
@@ -1587,12 +1628,13 @@ public function generateGitImportCommands(string $deployment_uuid, int $pull_req
                 if ($pull_request_id !== 0) {
                     $branch = "pull/{$pull_request_id}/head:$pr_branch_name";
 
-                    $git_checkout_command = $this->buildGitCheckoutCommand($pr_branch_name, gitConfigOptions: $gitConfigOption ?? null);
+                    $git_checkout_command = $this->buildGitCheckoutCommand($pr_branch_name, gitConfigOptions: $gitConfigOptions ?? null);
+                    $gitCommand = isset($gitConfigOptions) ? "git {$gitConfigOptions}" : 'git';
                     $escapedPrBranch = escapeshellarg($branch);
                     if ($exec_in_docker) {
-                        $commands->push(executeInDocker($deployment_uuid, "cd {$escapedBaseDir} && git fetch origin {$escapedPrBranch} && $git_checkout_command"));
+                        $commands->push(executeInDocker($deployment_uuid, "cd {$escapedBaseDir} && {$gitCommand} fetch origin {$escapedPrBranch} && $git_checkout_command"));
                     } else {
-                        $commands->push("cd {$escapedBaseDir} && git fetch origin {$escapedPrBranch} && $git_checkout_command");
+                        $commands->push("cd {$escapedBaseDir} && {$gitCommand} fetch origin {$escapedPrBranch} && $git_checkout_command");
                     }
                 }
 
@@ -1612,7 +1654,7 @@ public function generateGitImportCommands(string $deployment_uuid, int $pull_req
                     $private_key = base64_encode($private_key);
                     $gitlabPort = $gitlabSource->custom_port ?? 22;
                     $escapedCustomRepository = escapeshellarg($customRepository);
-                    $gitlabSshCommand = "ssh -o ConnectTimeout=30 -p {$gitlabPort} -o Port={$gitlabPort} -o LogLevel=ERROR -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i /root/.ssh/id_rsa";
+                    $gitlabSshCommand = "ssh -o ConnectTimeout=30 -p {$gitlabPort} -o Port={$gitlabPort} -o LogLevel=ERROR -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i {$customSshKeyLocation} -o IdentitiesOnly=yes";
                     $gitlabGitSshCommand = "GIT_SSH_COMMAND=\"{$gitlabSshCommand}\"";
                     $git_clone_command_base = "{$gitlabGitSshCommand} {$git_clone_command} {$escapedCustomRepository} {$escapedBaseDir}";
                     if ($only_checkout) {
@@ -1623,14 +1665,15 @@ public function generateGitImportCommands(string $deployment_uuid, int $pull_req
                     if ($exec_in_docker) {
                         $commands = collect([
                             executeInDocker($deployment_uuid, 'mkdir -p /root/.ssh'),
-                            executeInDocker($deployment_uuid, "echo '{$private_key}' | base64 -d | tee /root/.ssh/id_rsa > /dev/null"),
-                            executeInDocker($deployment_uuid, 'chmod 600 /root/.ssh/id_rsa'),
+                            executeInDocker($deployment_uuid, "echo '{$private_key}' | base64 -d | tee {$customSshKeyLocation} > /dev/null"),
+                            executeInDocker($deployment_uuid, "chmod 600 {$customSshKeyLocation}"),
                         ]);
                     } else {
                         $commands = collect([
+                            "trap 'rm -f {$customSshKeyLocation}' EXIT",
                             'mkdir -p /root/.ssh',
-                            "echo '{$private_key}' | base64 -d | tee /root/.ssh/id_rsa > /dev/null",
-                            'chmod 600 /root/.ssh/id_rsa',
+                            "echo '{$private_key}' | base64 -d | tee {$customSshKeyLocation} > /dev/null",
+                            "chmod 600 {$customSshKeyLocation}",
                         ]);
                     }
 
@@ -1661,7 +1704,11 @@ public function generateGitImportCommands(string $deployment_uuid, int $pull_req
                 $fullRepoUrl = $customRepository;
                 $escapedCustomRepository = escapeshellarg($customRepository);
                 $git_clone_command = "{$git_clone_command} {$escapedCustomRepository} {$escapedBaseDir}";
-                $git_clone_command = $this->setGitImportSettings($deployment_uuid, $git_clone_command, public: true, commit: $commit);
+                $gitConfigOptions = $this->isHttpGitRepository($customRepository) ? $this->withGitHttpTransportConfig() : null;
+                if ($gitConfigOptions) {
+                    $git_clone_command = $this->applyGitConfigOptionsToCloneCommand($git_clone_command, $gitConfigOptions);
+                }
+                $git_clone_command = $this->setGitImportSettings($deployment_uuid, $git_clone_command, public: true, commit: $commit, gitConfigOptions: $gitConfigOptions);
 
                 if ($exec_in_docker) {
                     $commands->push(executeInDocker($deployment_uuid, $git_clone_command));
@@ -1684,7 +1731,7 @@ public function generateGitImportCommands(string $deployment_uuid, int $pull_req
             }
             $private_key = base64_encode($private_key);
             $escapedCustomRepository = escapeshellarg($customRepository);
-            $deployKeySshCommand = "ssh -o ConnectTimeout=30 -p {$customPort} -o Port={$customPort} -o LogLevel=ERROR -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i /root/.ssh/id_rsa";
+            $deployKeySshCommand = "ssh -o ConnectTimeout=30 -p {$customPort} -o Port={$customPort} -o LogLevel=ERROR -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i {$customSshKeyLocation} -o IdentitiesOnly=yes";
             $deployKeyGitSshCommand = "GIT_SSH_COMMAND=\"{$deployKeySshCommand}\"";
             $git_clone_command_base = "{$deployKeyGitSshCommand} {$git_clone_command} {$escapedCustomRepository} {$escapedBaseDir}";
             if ($only_checkout) {
@@ -1695,14 +1742,15 @@ public function generateGitImportCommands(string $deployment_uuid, int $pull_req
             if ($exec_in_docker) {
                 $commands = collect([
                     executeInDocker($deployment_uuid, 'mkdir -p /root/.ssh'),
-                    executeInDocker($deployment_uuid, "echo '{$private_key}' | base64 -d | tee /root/.ssh/id_rsa > /dev/null"),
-                    executeInDocker($deployment_uuid, 'chmod 600 /root/.ssh/id_rsa'),
+                    executeInDocker($deployment_uuid, "echo '{$private_key}' | base64 -d | tee {$customSshKeyLocation} > /dev/null"),
+                    executeInDocker($deployment_uuid, "chmod 600 {$customSshKeyLocation}"),
                 ]);
             } else {
                 $commands = collect([
+                    "trap 'rm -f {$customSshKeyLocation}' EXIT",
                     'mkdir -p /root/.ssh',
-                    "echo '{$private_key}' | base64 -d | tee /root/.ssh/id_rsa > /dev/null",
-                    'chmod 600 /root/.ssh/id_rsa',
+                    "echo '{$private_key}' | base64 -d | tee {$customSshKeyLocation} > /dev/null",
+                    "chmod 600 {$customSshKeyLocation}",
                 ]);
             }
             if ($pull_request_id !== 0) {
@@ -1713,7 +1761,7 @@ public function generateGitImportCommands(string $deployment_uuid, int $pull_req
                     } else {
                         $commands->push("echo 'Checking out $branch'");
                     }
-                    $git_clone_command = "{$git_clone_command} && cd {$escapedBaseDir} && GIT_SSH_COMMAND=\"{$deployKeySshCommand}\" git fetch origin $branch && ".$this->buildGitCheckoutCommand($pr_branch_name, $deployKeySshCommand);
+                    $git_clone_command = "{$git_clone_command} && cd {$escapedBaseDir} && {$deployKeyGitSshCommand} git fetch origin $branch && ".$this->buildGitCheckoutCommand($pr_branch_name, $deployKeySshCommand);
                 } elseif ($git_type === 'github' || $git_type === 'gitea') {
                     $branch = "pull/{$pull_request_id}/head:$pr_branch_name";
                     if ($exec_in_docker) {
@@ -1721,14 +1769,14 @@ public function generateGitImportCommands(string $deployment_uuid, int $pull_req
                     } else {
                         $commands->push("echo 'Checking out $branch'");
                     }
-                    $git_clone_command = "{$git_clone_command} && cd {$escapedBaseDir} && GIT_SSH_COMMAND=\"{$deployKeySshCommand}\" git fetch origin $branch && ".$this->buildGitCheckoutCommand($pr_branch_name, $deployKeySshCommand);
+                    $git_clone_command = "{$git_clone_command} && cd {$escapedBaseDir} && {$deployKeyGitSshCommand} git fetch origin $branch && ".$this->buildGitCheckoutCommand($pr_branch_name, $deployKeySshCommand);
                 } elseif ($git_type === 'bitbucket') {
                     if ($exec_in_docker) {
                         $commands->push(executeInDocker($deployment_uuid, "echo 'Checking out $branch'"));
                     } else {
                         $commands->push("echo 'Checking out $branch'");
                     }
-                    $git_clone_command = "{$git_clone_command} && cd {$escapedBaseDir} && GIT_SSH_COMMAND=\"{$deployKeySshCommand}\" ".$this->buildGitCheckoutCommand($commit, $deployKeySshCommand);
+                    $git_clone_command = "{$git_clone_command} && cd {$escapedBaseDir} && {$deployKeyGitSshCommand} ".$this->buildGitCheckoutCommand($commit, $deployKeySshCommand);
                 }
             }
 
@@ -1748,10 +1796,15 @@ public function generateGitImportCommands(string $deployment_uuid, int $pull_req
             $fullRepoUrl = $customRepository;
             $escapedCustomRepository = escapeshellarg($customRepository);
             $git_clone_command = "{$git_clone_command} {$escapedCustomRepository} {$escapedBaseDir}";
-            $git_clone_command = $this->setGitImportSettings($deployment_uuid, $git_clone_command, public: true, commit: $commit);
+            $gitConfigOptions = $this->isHttpGitRepository($customRepository) ? $this->withGitHttpTransportConfig() : null;
+            if ($gitConfigOptions) {
+                $git_clone_command = $this->applyGitConfigOptionsToCloneCommand($git_clone_command, $gitConfigOptions);
+            }
+            $git_clone_command = $this->setGitImportSettings($deployment_uuid, $git_clone_command, public: true, commit: $commit, gitConfigOptions: $gitConfigOptions);
             $otherSshCommand = "ssh -o ConnectTimeout=30 -p {$customPort} -o Port={$customPort} -o LogLevel=ERROR -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i /root/.ssh/id_rsa";
 
             if ($pull_request_id !== 0) {
+                $gitCommand = isset($gitConfigOptions) ? "git {$gitConfigOptions}" : 'git';
                 if ($git_type === 'gitlab') {
                     $branch = "merge-requests/{$pull_request_id}/head:$pr_branch_name";
                     if ($exec_in_docker) {
@@ -1759,7 +1812,7 @@ public function generateGitImportCommands(string $deployment_uuid, int $pull_req
                     } else {
                         $commands->push("echo 'Checking out $branch'");
                     }
-                    $git_clone_command = "{$git_clone_command} && cd {$escapedBaseDir} && GIT_SSH_COMMAND=\"{$otherSshCommand}\" git fetch origin $branch && ".$this->buildGitCheckoutCommand($pr_branch_name, $otherSshCommand);
+                    $git_clone_command = "{$git_clone_command} && cd {$escapedBaseDir} && GIT_SSH_COMMAND=\"{$otherSshCommand}\" {$gitCommand} fetch origin $branch && ".$this->buildGitCheckoutCommand($pr_branch_name, $otherSshCommand, $gitConfigOptions);
                 } elseif ($git_type === 'github' || $git_type === 'gitea') {
                     $branch = "pull/{$pull_request_id}/head:$pr_branch_name";
                     if ($exec_in_docker) {
@@ -1767,14 +1820,14 @@ public function generateGitImportCommands(string $deployment_uuid, int $pull_req
                     } else {
                         $commands->push("echo 'Checking out $branch'");
                     }
-                    $git_clone_command = "{$git_clone_command} && cd {$escapedBaseDir} && GIT_SSH_COMMAND=\"{$otherSshCommand}\" git fetch origin $branch && ".$this->buildGitCheckoutCommand($pr_branch_name, $otherSshCommand);
+                    $git_clone_command = "{$git_clone_command} && cd {$escapedBaseDir} && GIT_SSH_COMMAND=\"{$otherSshCommand}\" {$gitCommand} fetch origin $branch && ".$this->buildGitCheckoutCommand($pr_branch_name, $otherSshCommand, $gitConfigOptions);
                 } elseif ($git_type === 'bitbucket') {
                     if ($exec_in_docker) {
                         $commands->push(executeInDocker($deployment_uuid, "echo 'Checking out $branch'"));
                     } else {
                         $commands->push("echo 'Checking out $branch'");
                     }
-                    $git_clone_command = "{$git_clone_command} && cd {$escapedBaseDir} && GIT_SSH_COMMAND=\"{$otherSshCommand}\" ".$this->buildGitCheckoutCommand($commit, $otherSshCommand);
+                    $git_clone_command = "{$git_clone_command} && cd {$escapedBaseDir} && GIT_SSH_COMMAND=\"{$otherSshCommand}\" ".$this->buildGitCheckoutCommand($commit, $otherSshCommand, $gitConfigOptions);
                 }
             }
 
@@ -1873,7 +1926,8 @@ public function loadComposeFile($isInit = false, ?string $restoreBaseDirectory =
             return;
         }
         $uuid = new Cuid2;
-        ['commands' => $cloneCommand] = $this->generateGitImportCommands(deployment_uuid: $uuid, only_checkout: true, exec_in_docker: false, custom_base_dir: '.');
+        ['commands' => $cloneCommand] = $this->generateGitImportCommands(deployment_uuid: $uuid, only_checkout: true, exec_in_docker: false, custom_base_dir: 'checkout');
+        $cloneCommand = str_replace(' clone ', ' clone --quiet ', $cloneCommand);
         $workdir = rtrim($this->base_directory, '/');
         $composeFile = $this->docker_compose_location;
         $fileList = collect([".$workdir$composeFile"]);
@@ -1903,6 +1957,7 @@ public function loadComposeFile($isInit = false, ?string $restoreBaseDirectory =
                 "mkdir -p /tmp/{$uuid}",
                 "cd /tmp/{$uuid}",
                 $cloneCommand,
+                'cd checkout',
                 'git sparse-checkout init',
                 "git sparse-checkout set {$fileList->implode(' ')}",
                 'git read-tree -mu HEAD',
@@ -1914,6 +1969,7 @@ public function loadComposeFile($isInit = false, ?string $restoreBaseDirectory =
                 "mkdir -p /tmp/{$uuid}",
                 "cd /tmp/{$uuid}",
                 $cloneCommand,
+                'cd checkout',
                 'git sparse-checkout init --cone',
                 "git sparse-checkout set {$fileList->implode(' ')}",
                 'git read-tree -mu HEAD',
@@ -2346,7 +2402,7 @@ public function setConfig($config)
             'config.build_pack' => 'required|string',
             'config.base_directory' => 'required|string',
             'config.publish_directory' => 'required|string',
-            'config.ports_exposes' => 'required|string',
+            'config.ports_exposes' => 'nullable|string',
             'config.settings.is_static' => 'required|boolean',
         ]);
         if ($deepValidator->fails()) {
diff --git a/app/Models/ApplicationDeploymentQueue.php b/app/Models/ApplicationDeploymentQueue.php
index afac89fa8..53fb8337f 100644
--- a/app/Models/ApplicationDeploymentQueue.php
+++ b/app/Models/ApplicationDeploymentQueue.php
@@ -2,6 +2,7 @@
 
 namespace App\Models;
 
+use App\Casts\EncryptedArrayCast;
 use Illuminate\Database\Eloquent\Casts\Attribute;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Support\Carbon;
@@ -74,11 +75,24 @@ class ApplicationDeploymentQueue extends Model
         'finished_at',
     ];
 
+    /**
+     * The configuration snapshot/diff hold full (decrypted on read) configuration,
+     * including unlocked environment variable values. They are only meant for the
+     * in-app diff modal (which redacts per role) and must never be serialized by the
+     * API, so hide them globally as defense in depth.
+     *
+     * @var array<int, string>
+     */
+    protected $hidden = [
+        'configuration_snapshot',
+        'configuration_diff',
+    ];
+
     protected $casts = [
         'pull_request_id' => 'integer',
         'finished_at' => 'datetime',
-        'configuration_snapshot' => 'array',
-        'configuration_diff' => 'array',
+        'configuration_snapshot' => EncryptedArrayCast::class,
+        'configuration_diff' => EncryptedArrayCast::class,
     ];
 
     public function application()
diff --git a/app/Models/Server.php b/app/Models/Server.php
index 74e8ba5b0..2b7bbac55 100644
--- a/app/Models/Server.php
+++ b/app/Models/Server.php
@@ -17,6 +17,7 @@
 use App\Notifications\Server\Reachable;
 use App\Notifications\Server\Unreachable;
 use App\Services\ConfigurationRepository;
+use App\Support\ValidationPatterns;
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasMetrics;
 use App\Traits\HasSafeStringAttribute;
@@ -945,10 +946,10 @@ public function user(): Attribute
     {
         return Attribute::make(
             get: function ($value) {
-                return preg_replace('/[^A-Za-z0-9\-_]/', '', $value);
+                return preg_replace(ValidationPatterns::INVALID_SERVER_USERNAME_CHARACTERS_PATTERN, '', $value);
             },
             set: function ($value) {
-                return preg_replace('/[^A-Za-z0-9\-_]/', '', $value);
+                return preg_replace(ValidationPatterns::INVALID_SERVER_USERNAME_CHARACTERS_PATTERN, '', $value);
             }
         );
     }
diff --git a/app/Models/StandaloneDocker.php b/app/Models/StandaloneDocker.php
index d12a15a7c..1c5cfd342 100644
--- a/app/Models/StandaloneDocker.php
+++ b/app/Models/StandaloneDocker.php
@@ -5,6 +5,7 @@
 use App\Jobs\ConnectProxyToNetworksJob;
 use App\Support\ValidationPatterns;
 use App\Traits\HasSafeStringAttribute;
+use Illuminate\Database\Eloquent\Collection;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
 
 class StandaloneDocker extends BaseModel
@@ -127,7 +128,7 @@ public function services()
         return $this->morphMany(Service::class, 'destination');
     }
 
-    public function databases()
+    public function databases(): Collection
     {
         $postgresqls = $this->postgresqls;
         $redis = $this->redis;
diff --git a/app/Notifications/Application/RestartLimitReached.php b/app/Notifications/Application/RestartLimitReached.php
new file mode 100644
index 000000000..635dfdbdc
--- /dev/null
+++ b/app/Notifications/Application/RestartLimitReached.php
@@ -0,0 +1,141 @@
+<?php
+
+namespace App\Notifications\Application;
+
+use App\Models\Application;
+use App\Notifications\CustomEmailNotification;
+use App\Notifications\Dto\DiscordMessage;
+use App\Notifications\Dto\PushoverMessage;
+use App\Notifications\Dto\SlackMessage;
+use Illuminate\Notifications\Messages\MailMessage;
+
+class RestartLimitReached extends CustomEmailNotification
+{
+    public string $resource_name;
+
+    public string $project_uuid;
+
+    public string $environment_uuid;
+
+    public string $environment_name;
+
+    public ?string $resource_url = null;
+
+    public ?string $fqdn;
+
+    public int $restart_count;
+
+    public int $max_restart_count;
+
+    public function __construct(public Application $resource)
+    {
+        $this->onQueue('high');
+        $this->afterCommit();
+        $this->resource_name = data_get($resource, 'name');
+        $this->project_uuid = data_get($resource, 'environment.project.uuid');
+        $this->environment_uuid = data_get($resource, 'environment.uuid');
+        $this->environment_name = data_get($resource, 'environment.name');
+        $this->fqdn = data_get($resource, 'fqdn', null);
+        $this->restart_count = $resource->restart_count;
+        $this->max_restart_count = $resource->max_restart_count;
+        if (str($this->fqdn)->explode(',')->count() > 1) {
+            $this->fqdn = str($this->fqdn)->explode(',')->first();
+        }
+        $this->resource_url = $this->resource->link() ?? base_url()."/project/{$this->project_uuid}/environment/{$this->environment_uuid}/application/{$this->resource->uuid}";
+    }
+
+    public function via(object $notifiable): array
+    {
+        return $notifiable->getEnabledChannels('status_change');
+    }
+
+    public function toMail(): MailMessage
+    {
+        $mail = new MailMessage;
+        $mail->subject("Coolify: {$this->resource_name} stopped - restart limit reached ({$this->restart_count}/{$this->max_restart_count})");
+        $mail->view('emails.application-restart-limit-reached', [
+            'name' => $this->resource_name,
+            'fqdn' => $this->fqdn,
+            'resource_url' => $this->resource_url,
+            'restart_count' => $this->restart_count,
+            'max_restart_count' => $this->max_restart_count,
+        ]);
+
+        return $mail;
+    }
+
+    public function toDiscord(): DiscordMessage
+    {
+        return new DiscordMessage(
+            title: ':warning: Restart limit reached',
+            description: "{$this->resource_name} has been stopped after {$this->restart_count} restarts (limit: {$this->max_restart_count}).\n\n[Open Application in Coolify]({$this->resource_url})",
+            color: DiscordMessage::errorColor(),
+            isCritical: true,
+        );
+    }
+
+    public function toTelegram(): array
+    {
+        $message = "Coolify: {$this->resource_name} has been stopped after {$this->restart_count} restarts (limit: {$this->max_restart_count}).";
+
+        return [
+            'message' => $message,
+            'buttons' => [
+                [
+                    'text' => 'Open Application in Coolify',
+                    'url' => $this->resource_url,
+                ],
+            ],
+        ];
+    }
+
+    public function toPushover(): PushoverMessage
+    {
+        $message = "{$this->resource_name} has been stopped after {$this->restart_count} restarts (limit: {$this->max_restart_count}).";
+
+        return new PushoverMessage(
+            title: 'Restart limit reached',
+            level: 'error',
+            message: $message,
+            buttons: [
+                [
+                    'text' => 'Open Application in Coolify',
+                    'url' => $this->resource_url,
+                ],
+            ],
+        );
+    }
+
+    public function toSlack(): SlackMessage
+    {
+        $title = 'Restart limit reached';
+        $description = "{$this->resource_name} has been stopped after {$this->restart_count} restarts (limit: {$this->max_restart_count})";
+
+        $description .= "\n\n*Project:* ".data_get($this->resource, 'environment.project.name');
+        $description .= "\n*Environment:* {$this->environment_name}";
+        $description .= "\n*Application URL:* {$this->resource_url}";
+
+        return new SlackMessage(
+            title: $title,
+            description: $description,
+            color: SlackMessage::errorColor()
+        );
+    }
+
+    public function toWebhook(): array
+    {
+        return [
+            'success' => false,
+            'message' => 'Restart limit reached',
+            'event' => 'restart_limit_reached',
+            'application_name' => $this->resource_name,
+            'application_uuid' => $this->resource->uuid,
+            'restart_count' => $this->restart_count,
+            'max_restart_count' => $this->max_restart_count,
+            'url' => $this->resource_url,
+            'project' => data_get($this->resource, 'environment.project.name'),
+            'environment' => $this->environment_name,
+            'fqdn' => $this->fqdn,
+        ];
+    }
+}
diff --git a/app/Services/DeploymentConfiguration/ApplicationConfigurationSnapshot.php b/app/Services/DeploymentConfiguration/ApplicationConfigurationSnapshot.php
index 8369f9a90..365708758 100644
--- a/app/Services/DeploymentConfiguration/ApplicationConfigurationSnapshot.php
+++ b/app/Services/DeploymentConfiguration/ApplicationConfigurationSnapshot.php
@@ -4,10 +4,13 @@
 
 use App\Models\Application;
 use App\Models\EnvironmentVariable;
+use App\Services\DeploymentConfiguration\Concerns\SummarizesDiffText;
 use Illuminate\Support\Arr;
 
 class ApplicationConfigurationSnapshot
 {
+    use SummarizesDiffText;
+
     public const SCHEMA_VERSION = 1;
 
     public function __construct(protected Application $application) {}
@@ -115,12 +118,14 @@ private function buildItems(): array
             $this->item('publish_directory', 'Publish directory', $this->application->publish_directory, 'build'),
             $this->item('install_command', 'Install command', $this->application->install_command, 'build'),
             $this->item('build_command', 'Build command', $this->application->build_command, 'build'),
-            $this->item('dockerfile', 'Dockerfile', $this->application->dockerfile, 'build', displayValue: $this->summarizeText($this->application->dockerfile)),
+            $this->item('dockerfile', 'Dockerfile', $this->application->dockerfile, 'build', displayValue: $this->summarizeText($this->application->dockerfile), displayFull: $this->application->dockerfile),
             $this->item('dockerfile_location', 'Dockerfile location', $this->application->dockerfile_location, 'build'),
             $this->item('dockerfile_target_build', 'Dockerfile target', $this->application->dockerfile_target_build, 'build'),
             $this->item('docker_compose_location', 'Docker Compose location', $this->application->docker_compose_location, 'build'),
-            $this->item('docker_compose', 'Docker Compose', $this->application->docker_compose, 'build', displayValue: $this->summarizeText($this->application->docker_compose)),
-            $this->item('docker_compose_raw', 'Raw Docker Compose', $this->application->docker_compose_raw, 'build', displayValue: $this->summarizeText($this->application->docker_compose_raw)),
+            // The generated docker_compose is intentionally excluded: it is re-rendered
+            // from git on every parse (resolved env, generated labels, deployment context),
+            // so comparing it would flag a permanent change for git-based compose apps.
+            $this->item('docker_compose_raw', 'Docker Compose', $this->application->docker_compose_raw, 'build', displayValue: $this->summarizeText($this->application->docker_compose_raw), displayFull: $this->application->docker_compose_raw, diffMode: 'lines'),
             $this->item('docker_compose_custom_build_command', 'Docker Compose custom build command', $this->application->docker_compose_custom_build_command, 'build'),
             $this->item('custom_docker_run_options', 'Custom Docker run options', $this->application->custom_docker_run_options, 'build'),
             $this->item('use_build_secrets', 'Use build secrets', data_get($this->application, 'settings.use_build_secrets'), 'build'),
@@ -162,9 +167,10 @@ private function domainItems(): array
     {
         return [
             $this->item('fqdn', 'Domains', $this->application->fqdn, 'redeploy'),
+            $this->item('docker_compose_domains', 'Service domains', $this->decodedComposeDomains(), 'redeploy', displayValue: $this->summarizeText($this->composeDomainsText()), displayFull: $this->composeDomainsText(), diffMode: 'lines'),
             $this->item('redirect', 'Redirect', $this->application->redirect, 'redeploy'),
-            $this->item('custom_labels', 'Container labels', $this->application->custom_labels, 'redeploy', displayValue: $this->summarizeText($this->application->custom_labels)),
-            $this->item('custom_nginx_configuration', 'Custom Nginx configuration', $this->application->custom_nginx_configuration, 'redeploy', displayValue: $this->summarizeText($this->application->custom_nginx_configuration)),
+            $this->item('custom_labels', 'Container labels', $this->application->custom_labels, 'redeploy', displayValue: $this->summarizeText($this->decodeCustomLabels($this->application->custom_labels)), displayFull: $this->decodeCustomLabels($this->application->custom_labels), diffMode: 'lines'),
+            $this->item('custom_nginx_configuration', 'Custom Nginx configuration', $this->application->custom_nginx_configuration, 'redeploy', displayValue: $this->summarizeText($this->application->custom_nginx_configuration), displayFull: $this->application->custom_nginx_configuration),
             $this->item('is_force_https_enabled', 'Force HTTPS', data_get($this->application, 'settings.is_force_https_enabled'), 'redeploy'),
             $this->item('is_gzip_enabled', 'Gzip', data_get($this->application, 'settings.is_gzip_enabled'), 'redeploy'),
             $this->item('is_stripprefix_enabled', 'Strip prefix', data_get($this->application, 'settings.is_stripprefix_enabled'), 'redeploy'),
@@ -234,6 +240,7 @@ private function limitItems(): array
     private function environmentItem(EnvironmentVariable $environmentVariable): array
     {
         $impact = $environmentVariable->is_buildtime ? 'build' : 'redeploy';
+        $locked = (bool) $environmentVariable->is_shown_once;
         $compareValue = [
             'value_hash' => $this->sensitiveHash($environmentVariable->value),
             'is_multiline' => $environmentVariable->is_multiline,
@@ -242,20 +249,62 @@ private function environmentItem(EnvironmentVariable $environmentVariable): arra
             'is_runtime' => $environmentVariable->is_runtime,
         ];
 
+        // Locked (is_shown_once) variables are always redacted and never store a value.
+        if ($locked) {
+            return $this->item(
+                key: (string) $environmentVariable->key,
+                label: (string) $environmentVariable->key,
+                value: $compareValue,
+                impact: $impact,
+                sensitive: true,
+                displayValue: $this->environmentDisplayValue($environmentVariable),
+            );
+        }
+
+        // Unlocked variables expose their value so owners/admins can see the change.
+        // The compare value is pre-hashed (identical formula to the locked branch) so
+        // change detection stays stable and never carries the raw value; members are
+        // redacted at render time in ConfigurationChecker; the column is encrypted at rest.
+        // The value and each scope flag are rendered as their own line and diffed by line,
+        // so a change to one or more attributes shows exactly what changed (one line each).
+        $value = (string) $environmentVariable->value;
+
         return $this->item(
             key: (string) $environmentVariable->key,
             label: (string) $environmentVariable->key,
-            value: $compareValue,
+            value: $this->sensitiveHash($this->normalizeValue($compareValue)),
             impact: $impact,
-            sensitive: true,
-            displayValue: $this->environmentDisplayValue($environmentVariable),
+            sensitive: false,
+            displayValue: $this->summarizeText($value),
+            displayFull: $this->environmentLines($environmentVariable),
+            diffMode: 'lines',
         );
     }
 
+    /**
+     * One line per attribute so the line diff surfaces exactly which value/flags changed.
+     */
+    private function environmentLines(EnvironmentVariable $environmentVariable): string
+    {
+        $lines = collect();
+
+        $value = (string) $environmentVariable->value;
+        if (filled($value)) {
+            $lines->push($value);
+        }
+
+        $lines->push('Available at build: '.($environmentVariable->is_buildtime ? 'enabled' : 'disabled'));
+        $lines->push('Available at runtime: '.($environmentVariable->is_runtime ? 'enabled' : 'disabled'));
+        $lines->push('Multiline: '.($environmentVariable->is_multiline ? 'enabled' : 'disabled'));
+        $lines->push('Literal: '.($environmentVariable->is_literal ? 'enabled' : 'disabled'));
+
+        return $lines->implode("\n");
+    }
+
     /**
      * @return array<string, mixed>
      */
-    private function item(string $key, string $label, mixed $value, string $impact, bool $sensitive = false, mixed $displayValue = null): array
+    private function item(string $key, string $label, mixed $value, string $impact, bool $sensitive = false, mixed $displayValue = null, ?string $displayFull = null, string $diffMode = 'default'): array
     {
         $normalizedValue = $this->normalizeValue($value);
 
@@ -264,21 +313,28 @@ private function item(string $key, string $label, mixed $value, string $impact,
             'label' => $label,
             'impact' => $impact,
             'sensitive' => $sensitive,
+            'diff_mode' => $diffMode,
             'compare_value' => $sensitive ? $this->sensitiveHash($normalizedValue) : $normalizedValue,
             'display_value' => $displayValue ?? $this->displayValue($normalizedValue),
+            'display_full' => $sensitive ? null : $this->expandableText($displayFull ?? $this->stringifyValue($normalizedValue)),
         ];
     }
 
     private function environmentDisplayValue(EnvironmentVariable $environmentVariable): string
     {
-        $flags = collect([
+        $flags = $this->environmentFlags($environmentVariable);
+
+        return $flags ? "Hidden ({$flags})" : 'Hidden';
+    }
+
+    private function environmentFlags(EnvironmentVariable $environmentVariable): string
+    {
+        return collect([
             $environmentVariable->is_buildtime ? 'build-time' : null,
             $environmentVariable->is_runtime ? 'runtime' : null,
             $environmentVariable->is_multiline ? 'multiline' : null,
             $environmentVariable->is_literal ? 'literal' : null,
         ])->filter()->implode(', ');
-
-        return $flags ? "Hidden ({$flags})" : 'Hidden';
     }
 
     private function sensitiveHash(mixed $value): string
@@ -320,6 +376,58 @@ private function displayValue(mixed $value): string
         return $this->summarizeText((string) $value);
     }
 
+    private function stringifyValue(mixed $value): ?string
+    {
+        if ($value === null || is_bool($value)) {
+            return null;
+        }
+
+        if (is_array($value)) {
+            return json_encode($value, JSON_THROW_ON_ERROR);
+        }
+
+        return (string) $value;
+    }
+
+    /**
+     * @return array<string, mixed>|null
+     */
+    private function decodedComposeDomains(): ?array
+    {
+        if (blank($this->application->docker_compose_domains)) {
+            return null;
+        }
+
+        $decoded = json_decode((string) $this->application->docker_compose_domains, true);
+
+        return is_array($decoded) ? $decoded : null;
+    }
+
+    private function composeDomainsText(): ?string
+    {
+        $decoded = $this->decodedComposeDomains();
+
+        if (blank($decoded)) {
+            return null;
+        }
+
+        return collect($decoded)
+            ->map(fn ($value, $service): string => $service.': '.(filled(data_get($value, 'domain')) ? data_get($value, 'domain') : '-'))
+            ->sort()
+            ->implode("\n");
+    }
+
+    private function decodeCustomLabels(?string $value): ?string
+    {
+        if (blank($value)) {
+            return null;
+        }
+
+        $decoded = base64_decode($value, true);
+
+        return $decoded === false ? $value : $decoded;
+    }
+
     private function summarizeText(?string $value): string
     {
         if (blank($value)) {
@@ -333,6 +441,6 @@ private function summarizeText(?string $value): string
             return str($value)->limit(80)." ({$lines} lines)";
         }
 
-        return str($value)->limit(120)->value();
+        return str($value)->limit(self::SINGLE_LINE_LIMIT)->value();
     }
 }
diff --git a/app/Services/DeploymentConfiguration/Concerns/SummarizesDiffText.php b/app/Services/DeploymentConfiguration/Concerns/SummarizesDiffText.php
new file mode 100644
index 000000000..6960a8f1b
--- /dev/null
+++ b/app/Services/DeploymentConfiguration/Concerns/SummarizesDiffText.php
@@ -0,0 +1,32 @@
+<?php
+
+namespace App\Services\DeploymentConfiguration\Concerns;
+
+trait SummarizesDiffText
+{
+    /**
+     * Maximum length of a single-line value before it is truncated/considered
+     * worth expanding. Kept as one constant so the snapshot summary and the
+     * differ's expand decision never drift apart.
+     */
+    private const SINGLE_LINE_LIMIT = 120;
+
+    /**
+     * Returns the value only when it is worth expanding (multi-line or longer
+     * than the single-line truncation limit). Otherwise null.
+     */
+    private function expandableText(?string $value): ?string
+    {
+        if (blank($value)) {
+            return null;
+        }
+
+        $value = trim((string) $value);
+
+        if (str_contains($value, "\n") || mb_strlen($value) > self::SINGLE_LINE_LIMIT) {
+            return $value;
+        }
+
+        return null;
+    }
+}
diff --git a/app/Services/DeploymentConfiguration/ConfigurationDiff.php b/app/Services/DeploymentConfiguration/ConfigurationDiff.php
index e8a206025..3f0477ba3 100644
--- a/app/Services/DeploymentConfiguration/ConfigurationDiff.php
+++ b/app/Services/DeploymentConfiguration/ConfigurationDiff.php
@@ -2,8 +2,6 @@
 
 namespace App\Services\DeploymentConfiguration;
 
-use Illuminate\Support\Collection;
-
 class ConfigurationDiff
 {
     /**
@@ -81,20 +79,6 @@ public function changes(): array
         return $this->changes;
     }
 
-    /**
-     * @return array<string, array{label: string, changes: array<int, array<string, mixed>>}>
-     */
-    public function groupedChanges(): array
-    {
-        return collect($this->changes)
-            ->groupBy('section')
-            ->map(fn (Collection $changes): array => [
-                'label' => (string) data_get($changes->first(), 'section_label', str((string) $changes->keys()->first())->headline()),
-                'changes' => $changes->values()->all(),
-            ])
-            ->all();
-    }
-
     /**
      * @return array{changed: bool, count: int, requires_build: bool, requires_redeploy: bool, legacy_fallback: bool, changes: array<int, array<string, mixed>>}
      */
diff --git a/app/Services/DeploymentConfiguration/ConfigurationDiffer.php b/app/Services/DeploymentConfiguration/ConfigurationDiffer.php
index b101b9d5b..e9707edbe 100644
--- a/app/Services/DeploymentConfiguration/ConfigurationDiffer.php
+++ b/app/Services/DeploymentConfiguration/ConfigurationDiffer.php
@@ -2,8 +2,21 @@
 
 namespace App\Services\DeploymentConfiguration;
 
+use App\Services\DeploymentConfiguration\Concerns\SummarizesDiffText;
+
 class ConfigurationDiffer
 {
+    use SummarizesDiffText;
+
+    /**
+     * Keys that must never be reported as changes. The generated docker_compose
+     * is re-rendered from git on every parse, so legacy snapshots that still
+     * contain it would otherwise flag a permanent change after it was dropped.
+     *
+     * @var array<int, string>
+     */
+    private const IGNORED_KEYS = ['build.docker_compose'];
+
     /**
      * @param  array<string, mixed>  $previousSnapshot
      * @param  array<string, mixed>  $currentSnapshot
@@ -16,6 +29,10 @@ public function diff(array $previousSnapshot, array $currentSnapshot): Configura
         $changes = [];
 
         foreach ($keys as $key) {
+            if (in_array($key, self::IGNORED_KEYS, true)) {
+                continue;
+            }
+
             $previous = $previousItems[$key] ?? null;
             $current = $currentItems[$key] ?? null;
 
@@ -27,6 +44,37 @@ public function diff(array $previousSnapshot, array $currentSnapshot): Configura
             $sensitive = (bool) data_get($item, 'sensitive', false);
             $type = $previous === null ? 'added' : ($current === null ? 'removed' : 'changed');
             $displaySummary = $sensitive && $type === 'changed' ? 'Changed' : null;
+            $diffMode = data_get($item, 'diff_mode', 'default');
+
+            $oldFull = null;
+            $newFull = null;
+
+            if ($sensitive) {
+                $oldDisplay = $previous === null ? '-' : '••••••••';
+                $newDisplay = $current === null ? '-' : '••••••••';
+            } elseif ($diffMode === 'lines' && $type === 'changed') {
+                [$oldDisplay, $newDisplay] = $this->changedLines(
+                    data_get($previous, 'display_full'),
+                    data_get($current, 'display_full'),
+                );
+
+                // No line-level difference (e.g. only reordering) — fall back to the summary.
+                if ($oldDisplay === '-' && $newDisplay === '-') {
+                    $oldDisplay = data_get($previous, 'display_value', '-');
+                    $newDisplay = data_get($current, 'display_value', '-');
+                }
+
+                // Expansion reveals the full changed lines, not the entire value.
+                $oldFull = $this->expandableText($oldDisplay);
+                $newFull = $this->expandableText($newDisplay);
+            } else {
+                $oldDisplay = data_get($previous, 'display_value', '-');
+                $newDisplay = data_get($current, 'display_value', '-');
+                $oldFull = data_get($previous, 'display_full');
+                $newFull = data_get($current, 'display_full');
+            }
+
+            $expandable = ! $sensitive && (filled($oldFull) || filled($newFull));
 
             $changes[] = [
                 'key' => $key,
@@ -37,14 +85,54 @@ public function diff(array $previousSnapshot, array $currentSnapshot): Configura
                 'impact' => data_get($item, 'impact', 'redeploy'),
                 'sensitive' => $sensitive,
                 'display_summary' => $displaySummary,
-                'old_display_value' => $sensitive ? ($previous === null ? '-' : '••••••••') : data_get($previous, 'display_value', '-'),
-                'new_display_value' => $sensitive ? ($current === null ? '-' : '••••••••') : data_get($current, 'display_value', '-'),
+                'old_display_value' => $oldDisplay,
+                'new_display_value' => $newDisplay,
+                'old_full_value' => $oldFull,
+                'new_full_value' => $newFull,
+                'expandable' => $expandable,
             ];
         }
 
         return ConfigurationDiff::fromChanges($changes);
     }
 
+    /**
+     * Reduce two multi-line values to only the lines that differ, so the modal
+     * shows just the changed container labels instead of the whole block.
+     *
+     * @return array{0: string, 1: string}
+     */
+    private function changedLines(?string $old, ?string $new): array
+    {
+        $oldLines = $this->textLines($old);
+        $newLines = $this->textLines($new);
+
+        $removed = array_values(array_diff($oldLines, $newLines));
+        $added = array_values(array_diff($newLines, $oldLines));
+
+        return [
+            $removed === [] ? '-' : implode("\n", $removed),
+            $added === [] ? '-' : implode("\n", $added),
+        ];
+    }
+
+    /**
+     * @return array<int, string>
+     */
+    private function textLines(?string $value): array
+    {
+        if (blank($value)) {
+            return [];
+        }
+
+        // Keep leading indentation (meaningful for YAML/compose), drop trailing whitespace.
+        return collect(preg_split('/\r\n|\r|\n/', (string) $value))
+            ->map(fn (string $line): string => rtrim($line))
+            ->filter(fn (string $line): bool => trim($line) !== '')
+            ->values()
+            ->all();
+    }
+
     /**
      * @param  array<string, mixed>  $snapshot
      * @return array<string, array<string, mixed>>
diff --git a/app/Support/ValidationPatterns.php b/app/Support/ValidationPatterns.php
index 7e3974dd7..bdb8654b9 100644
--- a/app/Support/ValidationPatterns.php
+++ b/app/Support/ValidationPatterns.php
@@ -35,6 +35,17 @@ class ValidationPatterns
      */
     public const DOCKER_TARGET_PATTERN = '/^[a-zA-Z0-9][a-zA-Z0-9._-]*$/';
 
+    /**
+     * Pattern for SSH usernames.
+     * Allows alphanumeric characters, dots, hyphens, and underscores.
+     */
+    public const SERVER_USERNAME_PATTERN = '/^[a-zA-Z0-9._-]+$/';
+
+    /**
+     * Pattern for removing characters not allowed in SSH usernames.
+     */
+    public const INVALID_SERVER_USERNAME_CHARACTERS_PATTERN = '/[^A-Za-z0-9.\-_]/';
+
     /**
      * Token-aware pattern for shell-safe command strings (docker compose commands, docker run options).
      *
@@ -283,6 +294,28 @@ public static function databaseIdentifierRules(bool $required = true, int $minLe
         return $rules;
     }
 
+    /**
+     * Get validation rules for SSH username fields.
+     */
+    public static function serverUsernameRules(bool $required = true): array
+    {
+        return [
+            $required ? 'required' : 'nullable',
+            'string',
+            'regex:'.self::SERVER_USERNAME_PATTERN,
+        ];
+    }
+
+    /**
+     * Get validation messages for SSH username fields.
+     */
+    public static function serverUsernameMessages(string $field = 'user', string $label = 'User'): array
+    {
+        return [
+            "{$field}.regex" => "The {$label} may only contain letters, numbers, dots, hyphens, and underscores.",
+        ];
+    }
+
     /**
      * Get validation messages for database identifier fields.
      */
diff --git a/app/Traits/SshRetryable.php b/app/Traits/SshRetryable.php
index 2092dc5f3..37303c7e6 100644
--- a/app/Traits/SshRetryable.php
+++ b/app/Traits/SshRetryable.php
@@ -40,6 +40,7 @@ protected function isRetryableSshError(string $errorOutput): bool
             'Remote host closed connection',
             'Authentication failed',
             'Too many authentication failures',
+            'SSH command failed with exit code: 255',
         ];
 
         $lowerErrorOutput = strtolower($errorOutput);
diff --git a/bootstrap/helpers/docker.php b/bootstrap/helpers/docker.php
index 5905ed3c1..2cf159bfd 100644
--- a/bootstrap/helpers/docker.php
+++ b/bootstrap/helpers/docker.php
@@ -86,7 +86,7 @@ function format_docker_command_output_to_json($rawOutput): Collection
         return $outputLines
             ->reject(fn ($line) => empty($line))
             ->map(fn ($outputLine) => json_decode($outputLine, true, flags: JSON_THROW_ON_ERROR));
-    } catch (\Throwable) {
+    } catch (Throwable) {
         return collect([]);
     }
 }
@@ -123,7 +123,7 @@ function format_docker_envs_to_json($rawOutput)
 
             return [$env[0] => $env[1]];
         });
-    } catch (\Throwable) {
+    } catch (Throwable) {
         return collect([]);
     }
 }
@@ -255,12 +255,12 @@ function defaultLabels($id, $name, string $projectName, string $resourceName, st
 
 function generateServiceSpecificFqdns(ServiceApplication|Application $resource)
 {
-    if ($resource->getMorphClass() === \App\Models\ServiceApplication::class) {
+    if ($resource->getMorphClass() === ServiceApplication::class) {
         $uuid = data_get($resource, 'uuid');
         $server = data_get($resource, 'service.server');
         $environment_variables = data_get($resource, 'service.environment_variables');
         $type = $resource->serviceType();
-    } elseif ($resource->getMorphClass() === \App\Models\Application::class) {
+    } elseif ($resource->getMorphClass() === Application::class) {
         $uuid = data_get($resource, 'uuid');
         $server = data_get($resource, 'destination.server');
         $environment_variables = data_get($resource, 'environment_variables');
@@ -641,7 +641,7 @@ function fqdnLabelsForTraefik(string $uuid, Collection $domains, bool $is_force_
                     }
                 }
             }
-        } catch (\Throwable) {
+        } catch (Throwable) {
             continue;
         }
     }
@@ -1000,6 +1000,7 @@ function convertDockerRunToCompose(?string $custom_docker_run_options = null)
         '--ulimit',
         '--device',
         '--shm-size',
+        '--dns',
     ]);
     $mapping = collect([
         '--cap-add' => 'cap_add',
@@ -1013,6 +1014,7 @@ function convertDockerRunToCompose(?string $custom_docker_run_options = null)
         '--ip' => 'ip',
         '--ip6' => 'ip6',
         '--shm-size' => 'shm_size',
+        '--dns' => 'dns',
         '--gpus' => 'gpus',
         '--hostname' => 'hostname',
         '--entrypoint' => 'entrypoint',
@@ -1219,7 +1221,7 @@ function validateComposeFile(string $compose, int $server_id): string|Throwable
     $server = Server::ownedByCurrentTeam()->find($server_id);
     try {
         if (! $server) {
-            throw new \Exception('Server not found');
+            throw new Exception('Server not found');
         }
         $yaml_compose = Yaml::parse($compose);
 
@@ -1235,7 +1237,7 @@ function validateComposeFile(string $compose, int $server_id): string|Throwable
         ], $server);
 
         return 'OK';
-    } catch (\Throwable $e) {
+    } catch (Throwable $e) {
         return $e->getMessage();
     } finally {
         if (filled($server)) {
@@ -1351,10 +1353,10 @@ function escapeBashDoubleQuoted(?string $value): string
  * Generate Docker build arguments from environment variables collection
  * Returns only keys (no values) since values are sourced from environment via export
  *
- * @param  \Illuminate\Support\Collection|array  $variables  Collection of variables with 'key', 'value', and optionally 'is_multiline'
- * @return \Illuminate\Support\Collection Collection of formatted --build-arg strings (keys only)
+ * @param  Collection|array  $variables  Collection of variables with 'key', 'value', and optionally 'is_multiline'
+ * @return Collection Collection of formatted --build-arg strings (keys only)
  */
-function generateDockerBuildArgs($variables): \Illuminate\Support\Collection
+function generateDockerBuildArgs($variables): Collection
 {
     $variables = collect($variables);
 
@@ -1369,7 +1371,7 @@ function generateDockerBuildArgs($variables): \Illuminate\Support\Collection
 /**
  * Generate Docker environment flags from environment variables collection
  *
- * @param  \Illuminate\Support\Collection|array  $variables  Collection of variables with 'key', 'value', and optionally 'is_multiline'
+ * @param  Collection|array  $variables  Collection of variables with 'key', 'value', and optionally 'is_multiline'
  * @return string Space-separated environment flags
  */
 function generateDockerEnvFlags($variables): string
diff --git a/bootstrap/helpers/github.php b/bootstrap/helpers/github.php
index 4a61960fb..0ec76f6fa 100644
--- a/bootstrap/helpers/github.php
+++ b/bootstrap/helpers/github.php
@@ -4,6 +4,7 @@
 use App\Models\GitlabApp;
 use Carbon\Carbon;
 use Carbon\CarbonImmutable;
+use Illuminate\Support\Facades\Cache;
 use Illuminate\Support\Facades\Http;
 use Illuminate\Support\Str;
 use Lcobucci\JWT\Encoding\ChainedFormatter;
@@ -20,7 +21,7 @@ function generateGithubToken(GithubApp $source, string $type)
     $timeDiff = abs($serverTime->diffInSeconds($githubTime));
 
     if ($timeDiff > 50) {
-        throw new \Exception(
+        throw new Exception(
             'System time is out of sync with GitHub API time:<br>'.
             '- System time: '.$serverTime->format('Y-m-d H:i:s').' UTC<br>'.
             '- GitHub time: '.$githubTime->format('Y-m-d H:i:s').' UTC<br>'.
@@ -60,7 +61,7 @@ function generateGithubToken(GithubApp $source, string $type)
 
             return $response->json()['token'];
         })(),
-        default => throw new \InvalidArgumentException("Unsupported token type: {$type}")
+        default => throw new InvalidArgumentException("Unsupported token type: {$type}")
     };
 }
 
@@ -77,11 +78,11 @@ function generateGithubJwt(GithubApp $source)
 function githubApi(GithubApp|GitlabApp|null $source, string $endpoint, string $method = 'get', ?array $data = null, bool $throwError = true)
 {
     if (is_null($source)) {
-        throw new \Exception('Source is required for API calls');
+        throw new Exception('Source is required for API calls');
     }
 
     if ($source->getMorphClass() !== GithubApp::class) {
-        throw new \InvalidArgumentException("Unsupported source type: {$source->getMorphClass()}");
+        throw new InvalidArgumentException("Unsupported source type: {$source->getMorphClass()}");
     }
 
     if ($source->is_public) {
@@ -100,7 +101,7 @@ function githubApi(GithubApp|GitlabApp|null $source, string $endpoint, string $m
         $errorMessage = data_get($response->json(), 'message', 'no error message found');
         $remainingCalls = $response->header('X-RateLimit-Remaining', '0');
 
-        throw new \Exception(
+        throw new Exception(
             'GitHub API call failed:<br>'.
             "Error: {$errorMessage}<br>".
             'Rate Limit Status:<br>'.
@@ -116,13 +117,19 @@ function githubApi(GithubApp|GitlabApp|null $source, string $endpoint, string $m
     ];
 }
 
-function getInstallationPath(GithubApp $source)
+function getInstallationPath(GithubApp $source): string
 {
-    $github = GithubApp::where('uuid', $source->uuid)->first();
-    $name = str(Str::kebab($github->name));
-    $installation_path = $github->html_url === 'https://github.com' ? 'apps' : 'github-apps';
+    $name = str(Str::kebab($source->name));
+    $installation_path = $source->html_url === 'https://github.com' ? 'apps' : 'github-apps';
+    $state = Str::random(64);
 
-    return "$github->html_url/$installation_path/$name/installations/new";
+    Cache::put('github-app-setup-state:'.hash('sha256', $state), [
+        'action' => 'install',
+        'github_app_id' => $source->id,
+        'team_id' => $source->team_id,
+    ], now()->addMinutes(60));
+
+    return "$source->html_url/$installation_path/$name/installations/new?".http_build_query(['state' => $state]);
 }
 
 function getPermissionsPath(GithubApp $source)
diff --git a/bootstrap/helpers/proxy.php b/bootstrap/helpers/proxy.php
index d443c84a4..699704393 100644
--- a/bootstrap/helpers/proxy.php
+++ b/bootstrap/helpers/proxy.php
@@ -4,6 +4,7 @@
 use App\Enums\ProxyTypes;
 use App\Models\Application;
 use App\Models\Server;
+use Illuminate\Support\Collection;
 use Illuminate\Support\Facades\Log;
 use Symfony\Component\Yaml\Yaml;
 
@@ -137,7 +138,7 @@ function connectProxyToNetworks(Server $server)
  * This must be called BEFORE docker compose up since the compose file declares networks as external.
  *
  * @param  Server  $server  The server to ensure networks on
- * @return \Illuminate\Support\Collection Commands to create networks if they don't exist
+ * @return Collection Commands to create networks if they don't exist
  */
 function ensureProxyNetworksExist(Server $server)
 {
@@ -215,7 +216,7 @@ function extractCustomProxyCommands(Server $server, string $existing_config): ar
                 $custom_commands[] = $command;
             }
         }
-    } catch (\Exception $e) {
+    } catch (Exception $e) {
         // If we can't parse the config, return empty array
         // Silently fail to avoid breaking the proxy regeneration
     }
@@ -436,7 +437,7 @@ function getExactTraefikVersionFromContainer(Server $server): ?string
         Log::debug("getExactTraefikVersionFromContainer: Server '{$server->name}' (ID: {$server->id}) - Could not detect exact version");
 
         return null;
-    } catch (\Exception $e) {
+    } catch (Exception $e) {
         Log::error("getExactTraefikVersionFromContainer: Server '{$server->name}' (ID: {$server->id}) - Error: ".$e->getMessage());
 
         return null;
@@ -483,7 +484,7 @@ function getTraefikVersionFromDockerCompose(Server $server): ?string
         Log::debug("getTraefikVersionFromDockerCompose: Server '{$server->name}' (ID: {$server->id}) - Image format doesn't match expected pattern: {$image}");
 
         return null;
-    } catch (\Exception $e) {
+    } catch (Exception $e) {
         Log::error("getTraefikVersionFromDockerCompose: Server '{$server->name}' (ID: {$server->id}) - Error: ".$e->getMessage());
 
         return null;
diff --git a/bootstrap/helpers/remoteProcess.php b/bootstrap/helpers/remoteProcess.php
index 60427377b..0f3a7c4dd 100644
--- a/bootstrap/helpers/remoteProcess.php
+++ b/bootstrap/helpers/remoteProcess.php
@@ -200,6 +200,7 @@ function decode_remote_command_output(?ApplicationDeploymentQueue $application_d
     }
     $application = Application::find(data_get($application_deployment_queue, 'application_id'));
     $is_debug_enabled = data_get($application, 'settings.is_debug_enabled');
+    $serverTimezone = getServerTimezone(data_get($application, 'destination.server'));
 
     // Members should never see debug logs, even if an admin enabled debug mode
     if ($is_debug_enabled && auth()->check() && auth()->user()->isMember()) {
@@ -245,8 +246,14 @@ function decode_remote_command_output(?ApplicationDeploymentQueue $application_d
 
     return $formatted
         ->sortBy(fn ($i) => data_get($i, 'order'))
-        ->map(function ($i) {
-            data_set($i, 'timestamp', Carbon::parse(data_get($i, 'timestamp'))->format('Y-M-d H:i:s.u'));
+        ->map(function ($i) use ($serverTimezone) {
+            $timestamp = Carbon::parse(data_get($i, 'timestamp'));
+            try {
+                $timestamp->setTimezone($serverTimezone);
+            } catch (Exception) {
+                $timestamp->setTimezone('UTC');
+            }
+            data_set($i, 'timestamp', $timestamp->format('Y-M-d H:i:s.u'));
 
             return $i;
         })
diff --git a/bootstrap/helpers/shared.php b/bootstrap/helpers/shared.php
index 08af8ee42..f2b672fef 100644
--- a/bootstrap/helpers/shared.php
+++ b/bootstrap/helpers/shared.php
@@ -1865,15 +1865,15 @@ function isBase64Encoded($strValue)
 {
     return base64_encode(base64_decode($strValue, true)) === $strValue;
 }
-function customApiValidator(Collection|array $item, array $rules)
+function customApiValidator(Collection|array $item, array $rules, array $messages = [])
 {
     if (is_array($item)) {
         $item = collect($item);
     }
 
-    return Validator::make($item->toArray(), $rules, [
+    return Validator::make($item->toArray(), $rules, array_merge([
         'required' => 'This field is required.',
-    ]);
+    ], $messages));
 }
 function parseDockerComposeFile(Service|Application $resource, bool $isNew = false, int $pull_request_id = 0, ?int $preview_id = null)
 {
diff --git a/config/constants.php b/config/constants.php
index fd66a682a..a01669673 100644
--- a/config/constants.php
+++ b/config/constants.php
@@ -68,6 +68,13 @@
     'ssh' => [
         'mux_enabled' => env('MUX_ENABLED', env('SSH_MUX_ENABLED', true)),
         'mux_persist_time' => env('SSH_MUX_PERSIST_TIME', 3600),
+        'mux_health_check_enabled' => env('SSH_MUX_HEALTH_CHECK_ENABLED', true),
+        'mux_health_check_timeout' => env('SSH_MUX_HEALTH_CHECK_TIMEOUT', 5),
+        'mux_max_age' => env('SSH_MUX_MAX_AGE', 1800), // 30 minutes
+        'mux_lock_ttl' => env('SSH_MUX_LOCK_TTL', 30), // lock auto-release, seconds
+        'mux_lock_timeout' => env('SSH_MUX_LOCK_TIMEOUT', 10), // max wait for lock, seconds
+        'mux_orphan_min_age' => env('SSH_MUX_ORPHAN_MIN_AGE', 600), // min process age before reaping orphans, seconds
+        'mux_orphan_reap_enabled' => env('SSH_MUX_ORPHAN_REAP_ENABLED', false), // false = dry-run, only log orphans
         'connection_timeout' => 10,
         'server_interval' => 20,
         'command_timeout' => 3600,
diff --git a/config/purify.php b/config/purify.php
index a5dcabb92..3d181d6eb 100644
--- a/config/purify.php
+++ b/config/purify.php
@@ -1,5 +1,6 @@
 <?php
 
+use Stevebauman\Purify\Cache\CacheDefinitionCache;
 use Stevebauman\Purify\Definitions\Html5Definition;
 
 return [
@@ -114,7 +115,7 @@
 
     'serializer' => [
         'driver' => env('CACHE_STORE', env('CACHE_DRIVER', 'file')),
-        'cache' => \Stevebauman\Purify\Cache\CacheDefinitionCache::class,
+        'cache' => CacheDefinitionCache::class,
     ],
 
     // 'serializer' => [
diff --git a/database/migrations/2026_03_26_000000_make_ports_exposes_nullable_in_applications_table.php b/database/migrations/2026_03_26_000000_make_ports_exposes_nullable_in_applications_table.php
new file mode 100644
index 000000000..ac7b5cb55
--- /dev/null
+++ b/database/migrations/2026_03_26_000000_make_ports_exposes_nullable_in_applications_table.php
@@ -0,0 +1,22 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('applications', function (Blueprint $table) {
+            $table->string('ports_exposes')->nullable()->change();
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('applications', function (Blueprint $table) {
+            $table->string('ports_exposes')->nullable(false)->default('')->change();
+        });
+    }
+};
diff --git a/database/migrations/2026_03_27_000000_add_max_restart_count_to_applications.php b/database/migrations/2026_03_27_000000_add_max_restart_count_to_applications.php
new file mode 100644
index 000000000..578959c9a
--- /dev/null
+++ b/database/migrations/2026_03_27_000000_add_max_restart_count_to_applications.php
@@ -0,0 +1,22 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('applications', function (Blueprint $blueprint) {
+            $blueprint->integer('max_restart_count')->default(10)->after('restart_count');
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('applications', function (Blueprint $blueprint) {
+            $blueprint->dropColumn('max_restart_count');
+        });
+    }
+};
diff --git a/database/migrations/2026_05_29_000000_encrypt_application_deployment_configuration_columns.php b/database/migrations/2026_05_29_000000_encrypt_application_deployment_configuration_columns.php
new file mode 100644
index 000000000..95500cfef
--- /dev/null
+++ b/database/migrations/2026_05_29_000000_encrypt_application_deployment_configuration_columns.php
@@ -0,0 +1,31 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Support\Facades\DB;
+
+return new class extends Migration
+{
+    /**
+     * The configuration snapshot/diff now store an encrypted blob (not valid
+     * JSON), so the columns must hold arbitrary text instead of json.
+     */
+    public function up(): void
+    {
+        if (DB::getDriverName() === 'sqlite') {
+            return;
+        }
+
+        DB::statement('ALTER TABLE application_deployment_queues ALTER COLUMN configuration_snapshot TYPE text USING configuration_snapshot::text');
+        DB::statement('ALTER TABLE application_deployment_queues ALTER COLUMN configuration_diff TYPE text USING configuration_diff::text');
+    }
+
+    public function down(): void
+    {
+        if (DB::getDriverName() === 'sqlite') {
+            return;
+        }
+
+        DB::statement('ALTER TABLE application_deployment_queues ALTER COLUMN configuration_snapshot TYPE json USING configuration_snapshot::json');
+        DB::statement('ALTER TABLE application_deployment_queues ALTER COLUMN configuration_diff TYPE json USING configuration_diff::json');
+    }
+};
diff --git a/database/seeders/SharedEnvironmentVariableSeeder.php b/database/seeders/SharedEnvironmentVariableSeeder.php
index 7a17fbd10..cfd2a3fef 100644
--- a/database/seeders/SharedEnvironmentVariableSeeder.php
+++ b/database/seeders/SharedEnvironmentVariableSeeder.php
@@ -35,7 +35,7 @@ public function run(): void
         ]);
 
         // Add predefined server variables to all existing servers
-        $servers = \App\Models\Server::all();
+        $servers = Server::all();
         foreach ($servers as $server) {
             SharedEnvironmentVariable::firstOrCreate([
                 'key' => 'COOLIFY_SERVER_UUID',
diff --git a/docker/testing-host/Dockerfile b/docker/testing-host/Dockerfile
index fdad3cc41..43b16981a 100644
--- a/docker/testing-host/Dockerfile
+++ b/docker/testing-host/Dockerfile
@@ -20,9 +20,22 @@ ENV PATH="/host/usr/local/sbin:/host/usr/local/bin:/host/usr/sbin:/host/usr/bin:
 
 RUN apt update && apt -y install openssh-client openssh-server curl wget git jq jc
 RUN mkdir -p ~/.docker/cli-plugins
-RUN curl -sSL https://github.com/docker/buildx/releases/download/v${DOCKER_BUILDX_VERSION}/buildx-v${DOCKER_BUILDX_VERSION}.linux-amd64 -o ~/.docker/cli-plugins/docker-buildx
-RUN curl -sSL https://github.com/docker/compose/releases/download/v${DOCKER_COMPOSE_VERSION}/docker-compose-linux-x86_64 -o ~/.docker/cli-plugins/docker-compose
-RUN (curl -sSL https://download.docker.com/linux/static/stable/x86_64/docker-${DOCKER_VERSION}.tgz | tar -C /usr/bin/ --no-same-owner -xzv --strip-components=1 docker/docker)
+
+# Download architecture-matched Docker CLI, buildx, and compose binaries.
+# This image is published as a multi-arch manifest (amd64 + arm64), so the
+# downloaded binaries must match TARGETPLATFORM or they fail with "exec format error"
+# when the container runs on the other architecture.
+RUN if [ "${TARGETPLATFORM}" = "linux/amd64" ]; then \
+        curl -sSL https://github.com/docker/buildx/releases/download/v${DOCKER_BUILDX_VERSION}/buildx-v${DOCKER_BUILDX_VERSION}.linux-amd64 -o ~/.docker/cli-plugins/docker-buildx && \
+        curl -sSL https://github.com/docker/compose/releases/download/v${DOCKER_COMPOSE_VERSION}/docker-compose-linux-x86_64 -o ~/.docker/cli-plugins/docker-compose && \
+        (curl -sSL https://download.docker.com/linux/static/stable/x86_64/docker-${DOCKER_VERSION}.tgz | tar -C /usr/bin/ --no-same-owner -xzv --strip-components=1 docker/docker); \
+    elif [ "${TARGETPLATFORM}" = "linux/arm64" ]; then \
+        curl -sSL https://github.com/docker/buildx/releases/download/v${DOCKER_BUILDX_VERSION}/buildx-v${DOCKER_BUILDX_VERSION}.linux-arm64 -o ~/.docker/cli-plugins/docker-buildx && \
+        curl -sSL https://github.com/docker/compose/releases/download/v${DOCKER_COMPOSE_VERSION}/docker-compose-linux-aarch64 -o ~/.docker/cli-plugins/docker-compose && \
+        (curl -sSL https://download.docker.com/linux/static/stable/aarch64/docker-${DOCKER_VERSION}.tgz | tar -C /usr/bin/ --no-same-owner -xzv --strip-components=1 docker/docker); \
+    else \
+        echo "Unsupported TARGETPLATFORM: ${TARGETPLATFORM}" && exit 1; \
+    fi
 RUN chmod +x ~/.docker/cli-plugins/docker-compose /usr/bin/docker /root/.docker/cli-plugins/docker-buildx
 
 
diff --git a/openapi.json b/openapi.json
index f3bda9ab8..ca445ade0 100644
--- a/openapi.json
+++ b/openapi.json
@@ -79,8 +79,7 @@
                                     "environment_uuid",
                                     "git_repository",
                                     "git_branch",
-                                    "build_pack",
-                                    "ports_exposes"
+                                    "build_pack"
                                 ],
                                 "properties": {
                                     "project_uuid": {
@@ -526,8 +525,7 @@
                                     "github_app_uuid",
                                     "git_repository",
                                     "git_branch",
-                                    "build_pack",
-                                    "ports_exposes"
+                                    "build_pack"
                                 ],
                                 "properties": {
                                     "project_uuid": {
@@ -977,8 +975,7 @@
                                     "private_key_uuid",
                                     "git_repository",
                                     "git_branch",
-                                    "build_pack",
-                                    "ports_exposes"
+                                    "build_pack"
                                 ],
                                 "properties": {
                                     "project_uuid": {
@@ -1775,8 +1772,7 @@
                                     "server_uuid",
                                     "environment_name",
                                     "environment_uuid",
-                                    "docker_registry_image_name",
-                                    "ports_exposes"
+                                    "docker_registry_image_name"
                                 ],
                                 "properties": {
                                     "project_uuid": {
diff --git a/openapi.yaml b/openapi.yaml
index fae8d7110..6182cacd3 100644
--- a/openapi.yaml
+++ b/openapi.yaml
@@ -59,7 +59,6 @@ paths:
                 - git_repository
                 - git_branch
                 - build_pack
-                - ports_exposes
               properties:
                 project_uuid:
                   type: string
@@ -344,7 +343,6 @@ paths:
                 - git_repository
                 - git_branch
                 - build_pack
-                - ports_exposes
               properties:
                 project_uuid:
                   type: string
@@ -632,7 +630,6 @@ paths:
                 - git_repository
                 - git_branch
                 - build_pack
-                - ports_exposes
               properties:
                 project_uuid:
                   type: string
@@ -1141,7 +1138,6 @@ paths:
                 - environment_name
                 - environment_uuid
                 - docker_registry_image_name
-                - ports_exposes
               properties:
                 project_uuid:
                   type: string
diff --git a/other/nightly/install.sh b/other/nightly/install.sh
index 4a91f7b1b..028652d80 100755
--- a/other/nightly/install.sh
+++ b/other/nightly/install.sh
@@ -781,10 +781,12 @@ curl -fsSL -L $CDN/.env.production -o /data/coolify/source/.env.production &
 PID3=$!
 curl -fsSL -L $CDN/upgrade.sh -o /data/coolify/source/upgrade.sh &
 PID4=$!
+curl -fsSL -L $CDN/upgrade-postgres.sh -o /data/coolify/source/upgrade-postgres.sh &
+PID5=$!
 
 # Wait for all downloads to complete and check for errors
 DOWNLOAD_FAILED=false
-for PID in $PID1 $PID2 $PID3 $PID4; do
+for PID in $PID1 $PID2 $PID3 $PID4 $PID5; do
     if ! wait $PID; then
         DOWNLOAD_FAILED=true
     fi
@@ -795,6 +797,7 @@ if [ "$DOWNLOAD_FAILED" = true ]; then
     exit 1
 fi
 
+chmod +x /data/coolify/source/upgrade.sh /data/coolify/source/upgrade-postgres.sh
 log "All configuration files downloaded successfully"
 echo "     Done."
 
diff --git a/other/nightly/upgrade-postgres.sh b/other/nightly/upgrade-postgres.sh
new file mode 100755
index 000000000..09065875e
--- /dev/null
+++ b/other/nightly/upgrade-postgres.sh
@@ -0,0 +1,405 @@
+#!/bin/bash
+## Explicit Coolify internal PostgreSQL major-version migrator.
+## This script is intentionally not run by upgrade.sh automatically.
+
+set -Eeuo pipefail
+
+SOURCE_DIR="/data/coolify/source"
+ENV_FILE="${SOURCE_DIR}/.env"
+BACKUP_DIR="/data/coolify/backups/internal-postgres"
+OVERRIDE_FILE="${SOURCE_DIR}/docker-compose.postgres-upgrade.yml"
+ROLLBACK_FILE="${SOURCE_DIR}/postgres-upgrade-rollback.env"
+DATE=$(date +%Y-%m-%d-%H-%M-%S)
+LOGFILE="${SOURCE_DIR}/postgres-upgrade-${DATE}.log"
+COMMAND="${1:-upgrade}"
+TARGET_MAJOR="${1:-18}"
+
+if [ "$COMMAND" = "rollback" ]; then
+    TARGET_MAJOR=""
+else
+    COMMAND="upgrade"
+fi
+
+TARGET_IMAGE="${COOLIFY_POSTGRES_TARGET_IMAGE:-postgres:${TARGET_MAJOR}-alpine}"
+TARGET_VOLUME="${COOLIFY_POSTGRES_TARGET_VOLUME:-coolify-db-pg${TARGET_MAJOR}}"
+TEMP_CONTAINER="coolify-db-pg${TARGET_MAJOR:-rollback}-restore-${DATE}"
+DUMP_FILE="${BACKUP_DIR}/postgres-upgrade-${DATE}.sql.gz"
+
+log() {
+    echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1" | tee -a "$LOGFILE"
+}
+
+fail() {
+    log "ERROR: $1"
+    exit 1
+}
+
+usage() {
+    cat <<EOF
+Usage:
+  $0 <target-major>
+  $0 rollback
+
+Examples:
+  $0 18
+  $0 rollback
+
+Environment overrides:
+  COOLIFY_POSTGRES_TARGET_IMAGE=postgres:18-alpine
+  COOLIFY_POSTGRES_TARGET_VOLUME=coolify-db-pg18
+EOF
+}
+
+cleanup() {
+    docker rm -f "$TEMP_CONTAINER" >/dev/null 2>&1 || true
+}
+trap cleanup EXIT
+
+get_env_var() {
+    local key="$1"
+    local fallback="${2:-}"
+    local value
+
+    value=$(grep -E "^${key}=" "$ENV_FILE" 2>/dev/null | tail -n 1 | cut -d '=' -f 2- || true)
+    value="${value%\"}"
+    value="${value#\"}"
+    value="${value%\'}"
+    value="${value#\'}"
+
+    if [ -z "$value" ]; then
+        printf '%s' "$fallback"
+    else
+        printf '%s' "$value"
+    fi
+}
+
+wait_for_postgres() {
+    local container="$1"
+    local user="$2"
+    local database="$3"
+    local attempts=60
+
+    for _ in $(seq 1 "$attempts"); do
+        if docker exec "$container" pg_isready -U "$user" -d "$database" >/dev/null 2>&1; then
+            return 0
+        fi
+        sleep 2
+    done
+
+    return 1
+}
+
+compose_files() {
+    printf -- '-f %s/docker-compose.yml -f %s/docker-compose.prod.yml ' "$SOURCE_DIR" "$SOURCE_DIR"
+
+    if [ -f "${SOURCE_DIR}/docker-compose.custom.yml" ]; then
+        printf -- '-f %s/docker-compose.custom.yml ' "$SOURCE_DIR"
+    fi
+
+    if [ -f "$OVERRIDE_FILE" ]; then
+        printf -- '-f %s ' "$OVERRIDE_FILE"
+    fi
+}
+
+validate_target_major() {
+    case "$TARGET_MAJOR" in
+        ''|*[!0-9]*)
+            usage
+            fail "Target major version must be numeric. Example: $0 18"
+            ;;
+    esac
+
+    if [ "$TARGET_MAJOR" -lt 10 ]; then
+        fail "Target major version must be 10 or higher."
+    fi
+}
+
+mount_path_for_major() {
+    local major="$1"
+
+    if [ "$major" -ge 18 ]; then
+        printf '%s' '/var/lib/postgresql'
+    else
+        printf '%s' '/var/lib/postgresql/data'
+    fi
+}
+
+current_postgres_mount_name() {
+    docker inspect coolify-db --format '{{range .Mounts}}{{if or (eq .Destination "/var/lib/postgresql/data") (eq .Destination "/var/lib/postgresql")}}{{.Name}}{{end}}{{end}}' 2>/dev/null
+}
+
+current_postgres_mount_path() {
+    docker inspect coolify-db --format '{{range .Mounts}}{{if or (eq .Destination "/var/lib/postgresql/data") (eq .Destination "/var/lib/postgresql")}}{{.Destination}}{{end}}{{end}}' 2>/dev/null
+}
+
+current_postgres_image() {
+    docker inspect coolify-db --format '{{.Config.Image}}' 2>/dev/null
+}
+
+current_coolify_image_tag() {
+    local image
+    local image_without_digest
+    local last_segment
+
+    image=$(docker inspect coolify --format '{{.Config.Image}}' 2>/dev/null || true)
+    image_without_digest="${image%@*}"
+    last_segment="${image_without_digest##*/}"
+
+    if [[ "$last_segment" == *:* ]]; then
+        printf '%s' "${last_segment##*:}"
+    fi
+}
+
+write_override_file() {
+    local image="$1"
+    local volume="$2"
+    local mount_path="$3"
+
+    cat > "$OVERRIDE_FILE" <<YAML
+services:
+  postgres:
+    image: "${image}"
+    volumes:
+      - coolify-db:${mount_path}
+volumes:
+  coolify-db:
+    name: "${volume}"
+    external: true
+YAML
+}
+
+write_rollback_file() {
+    local previous_image="$1"
+    local previous_volume="$2"
+    local previous_mount_path="$3"
+    local previous_override_present="$4"
+    local upgraded_image="$5"
+    local upgraded_volume="$6"
+
+    cat > "$ROLLBACK_FILE" <<EOF
+PREVIOUS_IMAGE='${previous_image}'
+PREVIOUS_VOLUME='${previous_volume}'
+PREVIOUS_MOUNT_PATH='${previous_mount_path}'
+PREVIOUS_OVERRIDE_PRESENT='${previous_override_present}'
+UPGRADED_IMAGE='${upgraded_image}'
+UPGRADED_VOLUME='${upgraded_volume}'
+CREATED_AT='${DATE}'
+EOF
+    chmod 600 "$ROLLBACK_FILE"
+}
+
+start_stack() {
+    local coolify_image_tag="${1:-${LATEST_IMAGE:-latest}}"
+    local files
+    files=$(compose_files)
+
+    # shellcheck disable=SC2086
+    LATEST_IMAGE="$coolify_image_tag" docker compose --env-file "$ENV_FILE" $files up -d --remove-orphans --wait --wait-timeout 120
+}
+
+print_rollback_instructions() {
+    cat <<EOF | tee -a "$LOGFILE"
+
+Rollback command if the upgraded database does not work:
+  ${SOURCE_DIR}/upgrade-postgres.sh rollback
+
+Rollback metadata was saved to:
+  ${ROLLBACK_FILE}
+
+The previous active Docker volume was '${PREVIOUS_VOLUME}'.
+The new Docker volume is '${TARGET_VOLUME}'.
+The dump file is '${DUMP_FILE}'.
+EOF
+}
+
+validate_common_requirements() {
+    mkdir -p "$BACKUP_DIR"
+    touch "$LOGFILE"
+    chmod 700 "$BACKUP_DIR"
+
+    [ -f "$ENV_FILE" ] || fail "Missing ${ENV_FILE}. Run this on a self-hosted Coolify server."
+    command -v docker >/dev/null 2>&1 || fail "Docker is required."
+    docker info >/dev/null 2>&1 || fail "Docker daemon is not reachable."
+}
+
+rollback_postgres() {
+    validate_common_requirements
+
+    [ -f "$ROLLBACK_FILE" ] || fail "Missing rollback metadata file: ${ROLLBACK_FILE}"
+
+    # shellcheck disable=SC1090
+    . "$ROLLBACK_FILE"
+
+    [ -n "${PREVIOUS_IMAGE:-}" ] || fail "Rollback metadata is missing PREVIOUS_IMAGE."
+    [ -n "${PREVIOUS_VOLUME:-}" ] || fail "Rollback metadata is missing PREVIOUS_VOLUME."
+    [ -n "${PREVIOUS_MOUNT_PATH:-}" ] || fail "Rollback metadata is missing PREVIOUS_MOUNT_PATH."
+    [ -n "${PREVIOUS_OVERRIDE_PRESENT:-}" ] || fail "Rollback metadata is missing PREVIOUS_OVERRIDE_PRESENT."
+
+    CURRENT_COOLIFY_IMAGE_TAG=$(current_coolify_image_tag)
+
+    log "Rolling back Coolify internal PostgreSQL."
+    log "Previous image: ${PREVIOUS_IMAGE}"
+    log "Previous volume: ${PREVIOUS_VOLUME}"
+    log "Previous mount path: ${PREVIOUS_MOUNT_PATH}"
+    log "Current Coolify image tag: ${CURRENT_COOLIFY_IMAGE_TAG:-latest}"
+
+    docker volume inspect "$PREVIOUS_VOLUME" >/dev/null 2>&1 || fail "Previous volume '${PREVIOUS_VOLUME}' does not exist."
+
+    log "Stopping Coolify application container before rollback."
+    docker stop coolify >>"$LOGFILE" 2>&1 || true
+
+    log "Removing current coolify-db container. Current upgraded volume is kept untouched."
+    docker rm -f coolify-db >>"$LOGFILE" 2>&1 || true
+
+    if [ "$PREVIOUS_OVERRIDE_PRESENT" = "true" ]; then
+        log "Restoring previous PostgreSQL compose override."
+        write_override_file "$PREVIOUS_IMAGE" "$PREVIOUS_VOLUME" "$PREVIOUS_MOUNT_PATH"
+    else
+        log "Removing PostgreSQL compose override to restore base compose configuration."
+        rm -f "$OVERRIDE_FILE"
+    fi
+
+    log "Starting Coolify stack with rollback database volume."
+    start_stack "$CURRENT_COOLIFY_IMAGE_TAG" >>"$LOGFILE" 2>&1 || fail "Could not start Coolify stack after rollback. See ${LOGFILE}."
+
+    log "Rollback completed successfully."
+    cat <<EOF | tee -a "$LOGFILE"
+
+Rollback completed.
+Current active PostgreSQL volume should be '${PREVIOUS_VOLUME}'.
+The upgraded volume '${UPGRADED_VOLUME:-unknown}' was left untouched for inspection or manual cleanup.
+EOF
+}
+
+upgrade_postgres() {
+    validate_target_major
+    TARGET_MOUNT_PATH=$(mount_path_for_major "$TARGET_MAJOR")
+    validate_common_requirements
+
+    log "Starting Coolify internal PostgreSQL major upgrade."
+    log "Target major: ${TARGET_MAJOR}"
+    log "Target image: ${TARGET_IMAGE}"
+    log "Target volume: ${TARGET_VOLUME}"
+    log "Target mount path: ${TARGET_MOUNT_PATH}"
+
+    DB_USERNAME=$(get_env_var DB_USERNAME coolify)
+    DB_DATABASE=$(get_env_var DB_DATABASE coolify)
+
+    if ! docker ps -a --format '{{.Names}}' | grep -qx 'coolify-db'; then
+        fail "Container 'coolify-db' was not found. Start Coolify before running this script."
+    fi
+
+    if ! docker ps --format '{{.Names}}' | grep -qx 'coolify-db'; then
+        log "Starting existing coolify-db container for version detection and dump."
+        docker start coolify-db >>"$LOGFILE" 2>&1 || fail "Could not start coolify-db."
+    fi
+
+    wait_for_postgres coolify-db "$DB_USERNAME" "$DB_DATABASE" || fail "Existing coolify-db is not ready."
+
+    SERVER_VERSION_NUM=$(docker exec coolify-db psql -U "$DB_USERNAME" -d "$DB_DATABASE" -Atc 'SHOW server_version_num;' | tr -d '[:space:]')
+    CURRENT_MAJOR=$((SERVER_VERSION_NUM / 10000))
+    PREVIOUS_VOLUME=$(current_postgres_mount_name)
+    PREVIOUS_MOUNT_PATH=$(current_postgres_mount_path)
+    PREVIOUS_IMAGE=$(current_postgres_image)
+    CURRENT_COOLIFY_IMAGE_TAG=$(current_coolify_image_tag)
+
+    [ -n "$PREVIOUS_VOLUME" ] || fail "Could not detect current PostgreSQL Docker volume."
+    [ -n "$PREVIOUS_MOUNT_PATH" ] || fail "Could not detect current PostgreSQL mount path."
+    [ -n "$PREVIOUS_IMAGE" ] || fail "Could not detect current PostgreSQL image."
+
+    if [ -f "$OVERRIDE_FILE" ]; then
+        PREVIOUS_OVERRIDE_PRESENT=true
+    else
+        PREVIOUS_OVERRIDE_PRESENT=false
+    fi
+
+    log "Current PostgreSQL major: ${CURRENT_MAJOR}"
+    log "Current active volume: ${PREVIOUS_VOLUME}"
+    log "Current image: ${PREVIOUS_IMAGE}"
+    log "Current mount path: ${PREVIOUS_MOUNT_PATH}"
+    log "Current Coolify image tag: ${CURRENT_COOLIFY_IMAGE_TAG:-latest}"
+
+    if [ "$CURRENT_MAJOR" -eq "$TARGET_MAJOR" ]; then
+        log "PostgreSQL is already on major ${TARGET_MAJOR}. Nothing to do."
+        exit 0
+    fi
+
+    if [ "$CURRENT_MAJOR" -gt "$TARGET_MAJOR" ]; then
+        fail "Downgrade from ${CURRENT_MAJOR} to ${TARGET_MAJOR} is not supported. Use '$0 rollback' to restore the previous upgrade state."
+    fi
+
+    if docker volume inspect "$TARGET_VOLUME" >/dev/null 2>&1; then
+        fail "Target volume '${TARGET_VOLUME}' already exists. Set COOLIFY_POSTGRES_TARGET_VOLUME to a new name or remove the old failed target volume."
+    fi
+
+    log "Stopping Coolify application container to prevent writes during dump."
+    docker stop coolify >>"$LOGFILE" 2>&1 || true
+
+    log "Creating compressed dump at ${DUMP_FILE}."
+    docker exec coolify-db pg_dumpall -U "$DB_USERNAME" | gzip -c > "$DUMP_FILE"
+    chmod 600 "$DUMP_FILE"
+
+    if [ ! -s "$DUMP_FILE" ]; then
+        fail "Dump file is empty. Aborting."
+    fi
+
+    log "Creating target Docker volume '${TARGET_VOLUME}'."
+    docker volume create "$TARGET_VOLUME" >>"$LOGFILE" 2>&1
+
+    log "Pulling ${TARGET_IMAGE}."
+    docker pull "$TARGET_IMAGE" >>"$LOGFILE" 2>&1
+
+    log "Starting temporary PostgreSQL ${TARGET_MAJOR} container."
+    docker run -d \
+        --name "$TEMP_CONTAINER" \
+        --network coolify \
+        -e POSTGRES_HOST_AUTH_METHOD=trust \
+        -v "${TARGET_VOLUME}:${TARGET_MOUNT_PATH}" \
+        "$TARGET_IMAGE" >>"$LOGFILE" 2>&1
+
+    wait_for_postgres "$TEMP_CONTAINER" postgres postgres || fail "Temporary PostgreSQL ${TARGET_MAJOR} container did not become ready."
+
+    log "Restoring dump into target volume."
+    gunzip -c "$DUMP_FILE" | docker exec -i "$TEMP_CONTAINER" psql -U postgres -d postgres >>"$LOGFILE" 2>&1
+
+    log "Smoke-checking restored Coolify database."
+    docker exec "$TEMP_CONTAINER" psql -U "$DB_USERNAME" -d "$DB_DATABASE" -Atc 'SELECT 1;' | grep -qx '1' || fail "Restored database smoke check failed."
+
+    log "Saving rollback metadata to ${ROLLBACK_FILE}."
+    write_rollback_file "$PREVIOUS_IMAGE" "$PREVIOUS_VOLUME" "$PREVIOUS_MOUNT_PATH" "$PREVIOUS_OVERRIDE_PRESENT" "$TARGET_IMAGE" "$TARGET_VOLUME"
+
+    log "Writing Docker Compose override to ${OVERRIDE_FILE}."
+    write_override_file "$TARGET_IMAGE" "$TARGET_VOLUME" "$TARGET_MOUNT_PATH"
+
+    log "Stopping temporary restore container."
+    docker rm -f "$TEMP_CONTAINER" >>"$LOGFILE" 2>&1 || true
+
+    log "Stopping old coolify-db container. Previous volume '${PREVIOUS_VOLUME}' will be kept for rollback."
+    docker rm -f coolify-db >>"$LOGFILE" 2>&1 || true
+
+    log "Starting Coolify stack with PostgreSQL ${TARGET_MAJOR}."
+    start_stack "$CURRENT_COOLIFY_IMAGE_TAG" >>"$LOGFILE" 2>&1 || fail "Could not start Coolify stack with upgraded PostgreSQL. See ${LOGFILE}."
+
+    log "Coolify internal PostgreSQL upgrade completed successfully."
+    print_rollback_instructions
+}
+
+if [ "${COOLIFY_POSTGRES_UPGRADE_SOURCE_ONLY:-false}" = "true" ] && [ "${BASH_SOURCE[0]}" != "$0" ]; then
+    return 0
+fi
+
+case "$COMMAND" in
+    rollback)
+        rollback_postgres
+        ;;
+    upgrade)
+        upgrade_postgres
+        ;;
+    -h|--help|help)
+        usage
+        ;;
+    *)
+        usage
+        fail "Unknown command: ${COMMAND}"
+        ;;
+esac
diff --git a/other/nightly/upgrade.sh b/other/nightly/upgrade.sh
index a21d39e41..8ccacb8a0 100644
--- a/other/nightly/upgrade.sh
+++ b/other/nightly/upgrade.sh
@@ -56,6 +56,9 @@ log "Downloading docker-compose.prod.yml from ${CDN}/docker-compose.prod.yml"
 curl -fsSL -L $CDN/docker-compose.prod.yml -o /data/coolify/source/docker-compose.prod.yml
 log "Downloading .env.production from ${CDN}/.env.production"
 curl -fsSL -L $CDN/.env.production -o /data/coolify/source/.env.production
+log "Downloading upgrade-postgres.sh from ${CDN}/upgrade-postgres.sh"
+curl -fsSL -L $CDN/upgrade-postgres.sh -o /data/coolify/source/upgrade-postgres.sh
+chmod +x /data/coolify/source/upgrade-postgres.sh
 log "Configuration files downloaded successfully"
 echo "     Done."
 
@@ -69,6 +72,12 @@ if [ -f /data/coolify/source/docker-compose.custom.yml ]; then
     log "Including custom docker-compose.yml in image extraction"
 fi
 
+# Check if PostgreSQL upgrade override exists
+if [ -f /data/coolify/source/docker-compose.postgres-upgrade.yml ]; then
+    COMPOSE_FILES="$COMPOSE_FILES -f /data/coolify/source/docker-compose.postgres-upgrade.yml"
+    log "Including PostgreSQL upgrade compose override in image extraction"
+fi
+
 # Get all unique images from docker compose config
 # LATEST_IMAGE env var is needed for image substitution in compose files
 IMAGES=$(LATEST_IMAGE=${LATEST_IMAGE} docker compose --env-file "$ENV_FILE" $COMPOSE_FILES config --images 2>/dev/null | sort -u)
@@ -236,15 +245,18 @@ nohup bash -c "
     echo '============================================================' >>\"\$LOGFILE\"
     write_status '5' 'Starting new containers'
 
+    COMPOSE_FILES='-f /data/coolify/source/docker-compose.yml -f /data/coolify/source/docker-compose.prod.yml'
     if [ -f /data/coolify/source/docker-compose.custom.yml ]; then
         log 'Using custom docker-compose.yml'
-        log 'Running docker compose up with custom configuration...'
-        docker run -v /data/coolify/source:/data/coolify/source -v /var/run/docker.sock:/var/run/docker.sock \${DOCKER_CONFIG_MOUNT} --rm \${REGISTRY_URL:-ghcr.io}/coollabsio/coolify-helper:\${LATEST_HELPER_VERSION} bash -c \"LATEST_IMAGE=\${LATEST_IMAGE} docker compose --env-file /data/coolify/source/.env -f /data/coolify/source/docker-compose.yml -f /data/coolify/source/docker-compose.prod.yml -f /data/coolify/source/docker-compose.custom.yml up -d --remove-orphans --wait --wait-timeout 60\" >>\"\$LOGFILE\" 2>&1
-    else
-        log 'Using standard docker-compose configuration'
-        log 'Running docker compose up...'
-        docker run -v /data/coolify/source:/data/coolify/source -v /var/run/docker.sock:/var/run/docker.sock \${DOCKER_CONFIG_MOUNT} --rm \${REGISTRY_URL:-ghcr.io}/coollabsio/coolify-helper:\${LATEST_HELPER_VERSION} bash -c \"LATEST_IMAGE=\${LATEST_IMAGE} docker compose --env-file /data/coolify/source/.env -f /data/coolify/source/docker-compose.yml -f /data/coolify/source/docker-compose.prod.yml up -d --remove-orphans --wait --wait-timeout 60\" >>\"\$LOGFILE\" 2>&1
+        COMPOSE_FILES=\"\$COMPOSE_FILES -f /data/coolify/source/docker-compose.custom.yml\"
     fi
+    if [ -f /data/coolify/source/docker-compose.postgres-upgrade.yml ]; then
+        log 'Using PostgreSQL upgrade compose override'
+        COMPOSE_FILES=\"\$COMPOSE_FILES -f /data/coolify/source/docker-compose.postgres-upgrade.yml\"
+    fi
+
+    log 'Running docker compose up...'
+    docker run -v /data/coolify/source:/data/coolify/source -v /var/run/docker.sock:/var/run/docker.sock \${DOCKER_CONFIG_MOUNT} --rm \${REGISTRY_URL:-ghcr.io}/coollabsio/coolify-helper:\${LATEST_HELPER_VERSION} bash -c \"LATEST_IMAGE=\${LATEST_IMAGE} docker compose --env-file /data/coolify/source/.env \${COMPOSE_FILES} up -d --remove-orphans --wait --wait-timeout 60\" >>\"\$LOGFILE\" 2>&1
     log 'Docker compose up completed'
 
     # Final log entry
diff --git a/resources/js/app.js b/resources/js/app.js
index 4dcae5f8e..96085bd96 100644
--- a/resources/js/app.js
+++ b/resources/js/app.js
@@ -1,5 +1,13 @@
 import { initializeTerminalComponent } from './terminal.js';
 
+// Livewire 3.5.19+ re-applies `x-cloak` to morphed elements during wire:navigate
+// (via replaceHtmlAttributes). With `[x-cloak]{display:none}` on the app wrapper,
+// this blanks the whole page on every navigation until Alpine re-processes it.
+// Strip leftover x-cloak after each navigation; the initial-load FOUC guard stays.
+document.addEventListener('livewire:navigated', () => {
+    document.querySelectorAll('[x-cloak]').forEach((el) => el.removeAttribute('x-cloak'));
+});
+
 ['livewire:navigated', 'alpine:init'].forEach((event) => {
     document.addEventListener(event, () => {
         // tree-shaking
diff --git a/resources/views/components/deployment/configuration-diff.blade.php b/resources/views/components/deployment/configuration-diff.blade.php
index f01481057..6aac5af4d 100644
--- a/resources/views/components/deployment/configuration-diff.blade.php
+++ b/resources/views/components/deployment/configuration-diff.blade.php
@@ -4,7 +4,7 @@
 ])
 
 @php
-    $changes = collect(data_get($diff, 'changes', []))->filter(fn ($change) => data_get($change, 'key') !== 'domains.custom_labels')->values()->all();
+    $changes = collect(data_get($diff, 'changes', []))->values()->all();
     $count = count($changes);
     $requiresBuild = collect($changes)->contains(fn ($change) => data_get($change, 'impact') === 'build');
 @endphp
@@ -41,16 +41,63 @@
                             </div>
                             <div class="divide-y divide-neutral-300 dark:divide-coolgray-200">
                                 @foreach ($sectionChanges as $change)
+                                    @php
+                                        $changeKey = (string) data_get($change, 'key');
+                                        $expandable = data_get($change, 'expandable', false);
+                                        $oldDisplay = (string) data_get($change, 'old_display_value');
+                                        $newDisplay = (string) data_get($change, 'new_display_value');
+                                        $oldFull = data_get($change, 'old_full_value') ?? $oldDisplay;
+                                        $newFull = data_get($change, 'new_full_value') ?? $newDisplay;
+                                        $label = (string) data_get($change, 'label');
+                                        $labelTruncated = mb_strlen($label) > 20;
+                                        $rowExpandable = $expandable || $labelTruncated;
+                                    @endphp
                                     <div class="grid grid-cols-[12rem_1fr_1.5rem_1fr] items-start gap-2 px-3 py-1.5 text-neutral-700 dark:text-neutral-300">
-                                        <div class="shrink-0 font-medium text-black dark:text-white">
-                                            {{ data_get($change, 'label') }}
+                                        <div class="min-w-0 shrink-0 font-medium text-black dark:text-white">
+                                            @if ($rowExpandable)
+                                                <div class="break-words"
+                                                    :class="expandedRows['{{ $changeKey }}'] ? '' : 'truncate'"
+                                                    x-text="expandedRows['{{ $changeKey }}'] ? @js($label) : @js((string) str($label)->limit(20))"></div>
+                                            @else
+                                                {{ $label }}
+                                            @endif
                                         </div>
-                                        <div class="truncate text-red-700 dark:text-red-400/80" title="{{ data_get($change, 'old_display_value') }}">
-                                            {{ data_get($change, 'old_display_value') }}
+                                        <div class="min-w-0 text-red-700 dark:text-red-400/80">
+                                            @if ($expandable)
+                                                <div class="break-words"
+                                                    :class="expandedRows['{{ $changeKey }}'] ? 'whitespace-pre-wrap' : 'truncate'"
+                                                    x-text="expandedRows['{{ $changeKey }}'] ? @js($oldFull) : @js($oldDisplay)"></div>
+                                            @else
+                                                <div class="truncate">{{ $oldDisplay }}</div>
+                                            @endif
                                         </div>
                                         <div class="text-center text-neutral-500 dark:text-neutral-400">→</div>
-                                        <div class="truncate text-green-700 dark:text-green-500" title="{{ data_get($change, 'new_display_value') }}">
-                                            {{ data_get($change, 'new_display_value') }}
+                                        <div class="flex min-w-0 items-start gap-1 text-green-700 dark:text-green-500">
+                                            <div class="min-w-0 flex-1">
+                                                @if ($expandable)
+                                                    <div class="break-words"
+                                                        :class="expandedRows['{{ $changeKey }}'] ? 'whitespace-pre-wrap' : 'truncate'"
+                                                        x-text="expandedRows['{{ $changeKey }}'] ? @js($newFull) : @js($newDisplay)"></div>
+                                                @else
+                                                    <div class="truncate">{{ $newDisplay }}</div>
+                                                @endif
+                                            </div>
+                                            @if ($rowExpandable)
+                                                <button type="button"
+                                                    x-on:click="expandedRows['{{ $changeKey }}'] = ! expandedRows['{{ $changeKey }}']"
+                                                    :aria-expanded="!! expandedRows['{{ $changeKey }}']"
+                                                    title="Toggle full value"
+                                                    class="mt-0.5 flex h-5 w-5 shrink-0 items-center justify-center text-neutral-400 transition hover:text-black dark:hover:text-white">
+                                                    <svg x-show="! expandedRows['{{ $changeKey }}']" class="h-3.5 w-3.5"
+                                                        viewBox="0 0 20 20" fill="currentColor">
+                                                        <path fill-rule="evenodd" d="M13.28 7.78l3.22-3.22v2.69a.75.75 0 0 0 1.5 0v-4.5a.75.75 0 0 0-.75-.75h-4.5a.75.75 0 0 0 0 1.5h2.69l-3.22 3.22a.75.75 0 0 0 1.06 1.06ZM2 17.25v-4.5a.75.75 0 0 1 1.5 0v2.69l3.22-3.22a.75.75 0 0 1 1.06 1.06L4.56 16.5h2.69a.75.75 0 0 1 0 1.5h-4.5a.75.75 0 0 1-.75-.75Z" clip-rule="evenodd" />
+                                                    </svg>
+                                                    <svg x-show="expandedRows['{{ $changeKey }}']" x-cloak class="h-3.5 w-3.5"
+                                                        viewBox="0 0 20 20" fill="currentColor">
+                                                        <path fill-rule="evenodd" d="M3.28 2.22a.75.75 0 0 0-1.06 1.06L5.44 6.5H2.75a.75.75 0 0 0 0 1.5h4.5A.75.75 0 0 0 8 7.25v-4.5a.75.75 0 0 0-1.5 0v2.69L3.28 2.22ZM13.5 2.75a.75.75 0 0 0-1.5 0v4.5c0 .414.336.75.75.75h4.5a.75.75 0 0 0 0-1.5h-2.69l3.22-3.22a.75.75 0 0 0-1.06-1.06L13.5 5.44V2.75ZM3.28 17.78l3.22-3.22v2.69a.75.75 0 0 0 1.5 0v-4.5a.75.75 0 0 0-.75-.75h-4.5a.75.75 0 0 0 0 1.5h2.69l-3.22 3.22a.75.75 0 1 0 1.06 1.06ZM12 12.75c0-.414.336-.75.75-.75h4.5a.75.75 0 0 1 0 1.5h-2.69l3.22 3.22a.75.75 0 1 1-1.06 1.06l-3.22-3.22v2.69a.75.75 0 0 1-1.5 0v-4.5Z" clip-rule="evenodd" />
+                                                    </svg>
+                                                </button>
+                                            @endif
                                         </div>
                                     </div>
                                 @endforeach
diff --git a/resources/views/components/forms/copy-button.blade.php b/resources/views/components/forms/copy-button.blade.php
index 12fadc595..eb3f3d8a4 100644
--- a/resources/views/components/forms/copy-button.blade.php
+++ b/resources/views/components/forms/copy-button.blade.php
@@ -1,7 +1,13 @@
-@props(['text'])
+@props(['text', 'label' => null])
 
-<div class="relative" x-data="{ copied: false, isSecure: window.isSecureContext }">
-    <input type="text" value="{{ $text }}" readonly class="input">
+<div class="w-full" x-data="{ copied: false, isSecure: window.isSecureContext }">
+    @if ($label)
+        <label class="flex gap-1 items-center mb-1 text-sm font-medium">{{ $label }}</label>
+    @endif
+    <div class="relative">
+        <input type="text" value="{{ $text }}" class="input pr-10"
+            @keydown.prevent @paste.prevent @cut.prevent @drop.prevent
+            @focus="$event.target.select()">
     <button
         x-show="isSecure"
         @click.prevent="copied = true; navigator.clipboard.writeText({{ Js::from($text) }}); setTimeout(() => copied = false, 1000)"
@@ -15,4 +21,5 @@ class="absolute right-2 top-1/2 -translate-y-1/2 p-1.5 text-gray-400 hover:text-
             <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M5 13l4 4L19 7" />
         </svg>
     </button>
+    </div>
 </div>
diff --git a/resources/views/components/forms/env-var-input.blade.php b/resources/views/components/forms/env-var-input.blade.php
index f637425c1..976c63b29 100644
--- a/resources/views/components/forms/env-var-input.blade.php
+++ b/resources/views/components/forms/env-var-input.blade.php
@@ -196,26 +196,6 @@
         }"
         @click.outside="showDropdown = false">
 
-        @if ($type === 'password' && $allowToPeak)
-            <button type="button" x-on:click="type = type === 'password' ? 'text' : 'password'"
-                class="flex absolute inset-y-0 right-0 z-10 items-center pr-2 cursor-pointer dark:hover:text-white"
-                aria-label="Toggle password visibility">
-                <svg x-show="type === 'password'" xmlns="http://www.w3.org/2000/svg" class="w-6 h-6" viewBox="0 0 24 24" stroke-width="1.5"
-                    stroke="currentColor" fill="none" stroke-linecap="round" stroke-linejoin="round">
-                    <path stroke="none" d="M0 0h24v24H0z" fill="none" />
-                    <path d="M10 12a2 2 0 1 0 4 0a2 2 0 0 0 -4 0" />
-                    <path d="M21 12c-2.4 4 -5.4 6 -9 6c-3.6 0 -6.6 -2 -9 -6c2.4 -4 5.4 -6 9 -6c3.6 0 6.6 2 9 6" />
-                </svg>
-                <svg x-cloak x-show="type === 'text'" xmlns="http://www.w3.org/2000/svg" class="w-6 h-6" viewBox="0 0 24 24" stroke-width="1.5"
-                    stroke="currentColor" fill="none" stroke-linecap="round" stroke-linejoin="round">
-                    <path stroke="none" d="M0 0h24v24H0z" fill="none" />
-                    <path d="M10.585 10.587a2 2 0 0 0 2.829 2.828" />
-                    <path d="M16.681 16.673a8.717 8.717 0 0 1 -4.681 1.327c-3.6 0 -6.6 -2 -9 -6c1.272 -2.12 2.712 -3.678 4.32 -4.674m2.86 -1.146a9.055 9.055 0 0 1 1.82 -.18c3.6 0 6.6 2 9 6c-.666 1.11 -1.379 2.067 -2.138 2.87" />
-                    <path d="M3 3l18 18" />
-                </svg>
-            </button>
-        @endif
-
         <input
             x-ref="input"
             @input="handleInput()"
@@ -241,6 +221,26 @@ class="flex absolute inset-y-0 right-0 z-10 items-center pr-2 cursor-pointer dar
             placeholder="{{ $attributes->get('placeholder') }}"
             @if ($autofocus) autofocus @endif>
 
+        @if ($type === 'password' && $allowToPeak)
+            <button type="button" x-on:click="type = type === 'password' ? 'text' : 'password'"
+                class="flex absolute inset-y-0 right-0 z-10 items-center pr-2 cursor-pointer dark:hover:text-white"
+                aria-label="Toggle password visibility">
+                <svg x-show="type === 'password'" xmlns="http://www.w3.org/2000/svg" class="w-6 h-6" viewBox="0 0 24 24" stroke-width="1.5"
+                    stroke="currentColor" fill="none" stroke-linecap="round" stroke-linejoin="round">
+                    <path stroke="none" d="M0 0h24v24H0z" fill="none" />
+                    <path d="M10 12a2 2 0 1 0 4 0a2 2 0 0 0 -4 0" />
+                    <path d="M21 12c-2.4 4 -5.4 6 -9 6c-3.6 0 -6.6 -2 -9 -6c2.4 -4 5.4 -6 9 -6c3.6 0 6.6 2 9 6" />
+                </svg>
+                <svg x-cloak x-show="type === 'text'" xmlns="http://www.w3.org/2000/svg" class="w-6 h-6" viewBox="0 0 24 24" stroke-width="1.5"
+                    stroke="currentColor" fill="none" stroke-linecap="round" stroke-linejoin="round">
+                    <path stroke="none" d="M0 0h24v24H0z" fill="none" />
+                    <path d="M10.585 10.587a2 2 0 0 0 2.829 2.828" />
+                    <path d="M16.681 16.673a8.717 8.717 0 0 1 -4.681 1.327c-3.6 0 -6.6 -2 -9 -6c1.272 -2.12 2.712 -3.678 4.32 -4.674m2.86 -1.146a9.055 9.055 0 0 1 1.82 -.18c3.6 0 6.6 2 9 6c-.666 1.11 -1.379 2.067 -2.138 2.87" />
+                    <path d="M3 3l18 18" />
+                </svg>
+            </button>
+        @endif
+
         {{-- Dropdown for suggestions --}}
         <div x-show="showDropdown"
              x-transition
diff --git a/resources/views/components/forms/input.blade.php b/resources/views/components/forms/input.blade.php
index 456aa1da8..c81f53ce9 100644
--- a/resources/views/components/forms/input.blade.php
+++ b/resources/views/components/forms/input.blade.php
@@ -14,6 +14,16 @@
     @endif
     @if ($type === 'password')
         <div class="relative" x-data="{ type: 'password' }" @success.window="type = 'password'">
+            <input autocomplete="{{ $autocomplete }}" value="{{ $value }}"
+                x-bind:type="type"
+                x-bind:class="{ 'truncate': type === 'text' && ! $el.disabled }"
+                {{ $attributes->merge(['class' => $defaultClass]) }} @required($required)
+                @if ($modelBinding !== 'null') wire:model={{ $modelBinding }} wire:dirty.class="[box-shadow:inset_4px_0_0_#6b16ed,inset_0_0_0_2px_#e5e5e5] dark:[box-shadow:inset_4px_0_0_#fcd452,inset_0_0_0_2px_#242424]" @endif
+                wire:loading.attr="disabled"
+                @readonly($readonly) @disabled($disabled) id="{{ $htmlId }}"
+                name="{{ $name }}" placeholder="{{ $attributes->get('placeholder') }}"
+                aria-placeholder="{{ $attributes->get('placeholder') }}"
+                @if ($autofocus) x-ref="autofocusInput" @endif>
             @if ($allowToPeak)
                 <button type="button" x-on:click="type = type === 'password' ? 'text' : 'password'"
                     class="flex absolute inset-y-0 right-0 items-center pr-2 cursor-pointer dark:hover:text-white"
@@ -35,16 +45,6 @@ class="flex absolute inset-y-0 right-0 items-center pr-2 cursor-pointer dark:hov
                     </svg>
                 </button>
             @endif
-            <input autocomplete="{{ $autocomplete }}" value="{{ $value }}"
-                x-bind:type="type"
-                x-bind:class="{ 'truncate': type === 'text' && ! $el.disabled }"
-                {{ $attributes->merge(['class' => $defaultClass]) }} @required($required)
-                @if ($modelBinding !== 'null') wire:model={{ $modelBinding }} wire:dirty.class="[box-shadow:inset_4px_0_0_#6b16ed,inset_0_0_0_2px_#e5e5e5] dark:[box-shadow:inset_4px_0_0_#fcd452,inset_0_0_0_2px_#242424]" @endif
-                wire:loading.attr="disabled"
-                @readonly($readonly) @disabled($disabled) id="{{ $htmlId }}"
-                name="{{ $name }}" placeholder="{{ $attributes->get('placeholder') }}"
-                aria-placeholder="{{ $attributes->get('placeholder') }}"
-                @if ($autofocus) x-ref="autofocusInput" @endif>
 
         </div>
     @else
diff --git a/resources/views/components/forms/textarea.blade.php b/resources/views/components/forms/textarea.blade.php
index 22c89fd72..752e67433 100644
--- a/resources/views/components/forms/textarea.blade.php
+++ b/resources/views/components/forms/textarea.blade.php
@@ -31,6 +31,21 @@ function handleKeydown(e) {
     @else
         @if ($type === 'password')
             <div class="relative" x-data="{ type: 'password' }" @success.window="type = 'password'">
+                <input x-cloak x-show="type === 'password'" value="{{ $value }}"
+                    {{ $attributes->merge(['class' => $defaultClassInput]) }} @required($required)
+                    @if ($modelBinding !== 'null') wire:model={{ $modelBinding }} wire:dirty.class="[box-shadow:inset_4px_0_0_#6b16ed,inset_0_0_0_2px_#e5e5e5] dark:[box-shadow:inset_4px_0_0_#fcd452,inset_0_0_0_2px_#242424]" @endif
+                    wire:loading.attr="disabled"
+                    type="{{ $type }}" @readonly($readonly) @disabled($disabled) id="{{ $htmlId }}"
+                    name="{{ $name }}" placeholder="{{ $attributes->get('placeholder') }}"
+                    aria-placeholder="{{ $attributes->get('placeholder') }}">
+                <textarea minlength="{{ $minlength }}" maxlength="{{ $maxlength }}" x-cloak x-show="type !== 'password'"
+                    placeholder="{{ $placeholder }}" {{ $attributes->merge(['class' => $defaultClass]) }}
+                    @if ($realtimeValidation) wire:model.debounce.200ms="{{ $modelBinding }}" wire:dirty.class="[box-shadow:inset_4px_0_0_#6b16ed,inset_0_0_0_2px_#e5e5e5] dark:[box-shadow:inset_4px_0_0_#fcd452,inset_0_0_0_2px_#242424]"
+                @else
+            wire:model={{ $value ?? $modelBinding }} wire:dirty.class="[box-shadow:inset_4px_0_0_#6b16ed,inset_0_0_0_2px_#e5e5e5] dark:[box-shadow:inset_4px_0_0_#fcd452,inset_0_0_0_2px_#242424]" @endif
+                    @disabled($disabled) @readonly($readonly) @required($required) id="{{ $htmlId }}"
+                    name="{{ $name }}" name={{ $modelBinding }}
+                    @if ($autofocus) x-ref="autofocusInput" @endif></textarea>
                 @if ($allowToPeak)
                     <button type="button" x-on:click="type = type === 'password' ? 'text' : 'password'"
                         class="absolute inset-y-0 right-0 flex items-center h-6 pt-2 pr-2 cursor-pointer dark:hover:text-white"
@@ -51,21 +66,6 @@ class="absolute inset-y-0 right-0 flex items-center h-6 pt-2 pr-2 cursor-pointer
                         </svg>
                     </button>
                 @endif
-                <input x-cloak x-show="type === 'password'" value="{{ $value }}"
-                    {{ $attributes->merge(['class' => $defaultClassInput]) }} @required($required)
-                    @if ($modelBinding !== 'null') wire:model={{ $modelBinding }} wire:dirty.class="[box-shadow:inset_4px_0_0_#6b16ed,inset_0_0_0_2px_#e5e5e5] dark:[box-shadow:inset_4px_0_0_#fcd452,inset_0_0_0_2px_#242424]" @endif
-                    wire:loading.attr="disabled"
-                    type="{{ $type }}" @readonly($readonly) @disabled($disabled) id="{{ $htmlId }}"
-                    name="{{ $name }}" placeholder="{{ $attributes->get('placeholder') }}"
-                    aria-placeholder="{{ $attributes->get('placeholder') }}">
-                <textarea minlength="{{ $minlength }}" maxlength="{{ $maxlength }}" x-cloak x-show="type !== 'password'"
-                    placeholder="{{ $placeholder }}" {{ $attributes->merge(['class' => $defaultClass]) }}
-                    @if ($realtimeValidation) wire:model.debounce.200ms="{{ $modelBinding }}" wire:dirty.class="[box-shadow:inset_4px_0_0_#6b16ed,inset_0_0_0_2px_#e5e5e5] dark:[box-shadow:inset_4px_0_0_#fcd452,inset_0_0_0_2px_#242424]"
-                @else
-            wire:model={{ $value ?? $modelBinding }} wire:dirty.class="[box-shadow:inset_4px_0_0_#6b16ed,inset_0_0_0_2px_#e5e5e5] dark:[box-shadow:inset_4px_0_0_#fcd452,inset_0_0_0_2px_#242424]" @endif
-                    @disabled($disabled) @readonly($readonly) @required($required) id="{{ $htmlId }}"
-                    name="{{ $name }}" name={{ $modelBinding }}
-                    @if ($autofocus) x-ref="autofocusInput" @endif></textarea>
 
             </div>
         @else
diff --git a/resources/views/components/modal-input.blade.php b/resources/views/components/modal-input.blade.php
index bdc9d9ac7..dc1191b44 100644
--- a/resources/views/components/modal-input.blade.php
+++ b/resources/views/components/modal-input.blade.php
@@ -36,32 +36,34 @@ class="relative w-auto h-auto" wire:ignore>
     <template x-teleport="body">
         <div x-show="modalOpen"
             x-init="$watch('modalOpen', value => { if(value) { $nextTick(() => { const firstInput = $el.querySelector('input, textarea, select'); firstInput?.focus(); }) } })"
-            class="fixed top-0 left-0 z-99 flex items-center justify-center w-screen h-screen p-4">
+            class="fixed inset-0 z-99 overflow-y-auto">
             <div x-show="modalOpen" x-transition:enter="ease-out duration-100" x-transition:enter-start="opacity-0"
                 x-transition:enter-end="opacity-100" x-transition:leave="ease-in duration-100"
                 x-transition:leave-start="opacity-100" x-transition:leave-end="opacity-0"
-                @if ($closeOutside) @click="modalOpen=false" @endif
                 class="absolute inset-0 w-full h-full bg-black/20 backdrop-blur-xs"></div>
-            <div id="{{ $modalId }}" x-show="modalOpen" x-trap.inert.noscroll="modalOpen"
-                x-transition:enter="ease-out duration-100"
-                x-transition:enter-start="opacity-0 -translate-y-2 sm:scale-95"
-                x-transition:enter-end="opacity-100 translate-y-0 sm:scale-100"
-                x-transition:leave="ease-in duration-100"
-                x-transition:leave-start="opacity-100 translate-y-0 sm:scale-100"
-                x-transition:leave-end="opacity-0 -translate-y-2 sm:scale-95"
-                class="relative w-full lg:w-auto lg:min-w-2xl lg:max-w-4xl border rounded-sm drop-shadow-sm bg-white border-neutral-200 dark:bg-base dark:border-coolgray-300 flex flex-col">
-                <div class="flex items-center justify-between py-6 px-6 shrink-0">
-                    <h3 class="text-2xl font-bold">{{ $title }}</h3>
-                    <button @click="modalOpen=false"
-                        class="absolute top-0 right-0 flex items-center justify-center w-8 h-8 mt-5 mr-5 rounded-full dark:text-white hover:bg-neutral-100 dark:hover:bg-coolgray-300 outline-0 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-coollabs dark:focus-visible:ring-warning focus-visible:ring-offset-2 dark:focus-visible:ring-offset-base">
-                        <svg class="w-5 h-5" xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24"
-                            stroke-width="1.5" stroke="currentColor">
-                            <path stroke-linecap="round" stroke-linejoin="round" d="M6 18L18 6M6 6l12 12" />
-                        </svg>
-                    </button>
-                </div>
-                <div class="relative flex items-center justify-center w-auto px-6 pb-6">
-                    {{ $slot }}
+            <div @if ($closeOutside) @click.self="modalOpen=false" @endif class="relative flex min-h-full items-start justify-center p-4 sm:items-center">
+                <div id="{{ $modalId }}" x-show="modalOpen" x-trap.inert.noscroll="modalOpen"
+                    x-transition:enter="ease-out duration-100"
+                    x-transition:enter-start="opacity-0 -translate-y-2 sm:scale-95"
+                    x-transition:enter-end="opacity-100 translate-y-0 sm:scale-100"
+                    x-transition:leave="ease-in duration-100"
+                    x-transition:leave-start="opacity-100 translate-y-0 sm:scale-100"
+                    x-transition:leave-end="opacity-0 -translate-y-2 sm:scale-95"
+                    class="relative flex max-h-[calc(100dvh-2rem)] w-full flex-col overflow-hidden rounded-sm border border-neutral-200 bg-white drop-shadow-sm dark:border-coolgray-300 dark:bg-base lg:w-auto lg:min-w-2xl lg:max-w-4xl">
+                    <div class="flex items-center justify-between py-6 px-6 shrink-0">
+                        <h3 class="text-2xl font-bold">{{ $title }}</h3>
+                        <button @click="modalOpen=false"
+                            class="absolute cursor-pointer top-0 right-0 flex items-center justify-center w-8 h-8 mt-5 mr-5 rounded-full dark:text-white hover:bg-neutral-100 dark:hover:bg-coolgray-300 outline-0 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-coollabs dark:focus-visible:ring-warning focus-visible:ring-offset-2 dark:focus-visible:ring-offset-base">
+                            <svg class="w-5 h-5" xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24"
+                                stroke-width="1.5" stroke="currentColor">
+                                <path stroke-linecap="round" stroke-linejoin="round" d="M6 18L18 6M6 6l12 12" />
+                            </svg>
+                        </button>
+                    </div>
+                    <div class="relative min-h-0 flex-1 overflow-y-auto px-6 pb-6 pt-1"
+                        style="-webkit-overflow-scrolling: touch;">
+                        {{ $slot }}
+                    </div>
                 </div>
             </div>
         </div>
diff --git a/resources/views/components/server/sidebar-sentinel.blade.php b/resources/views/components/server/sidebar-sentinel.blade.php
new file mode 100644
index 000000000..8125fe22c
--- /dev/null
+++ b/resources/views/components/server/sidebar-sentinel.blade.php
@@ -0,0 +1,10 @@
+<div class="sub-menu-wrapper">
+    <a class="{{ request()->routeIs('server.sentinel') ? 'sub-menu-item menu-item-active' : 'sub-menu-item' }}" {{ wireNavigate() }}
+        href="{{ route('server.sentinel', $parameters) }}">
+        <span class="menu-item-label">Configuration</span>
+    </a>
+    <a class="{{ request()->routeIs('server.sentinel.logs') ? 'sub-menu-item menu-item-active' : 'sub-menu-item' }}" {{ wireNavigate() }}
+        href="{{ route('server.sentinel.logs', $parameters) }}">
+        <span class="menu-item-label">Logs</span>
+    </a>
+</div>
diff --git a/resources/views/components/server/sidebar.blade.php b/resources/views/components/server/sidebar.blade.php
index 6c62701b8..2beb677be 100644
--- a/resources/views/components/server/sidebar.blade.php
+++ b/resources/views/components/server/sidebar.blade.php
@@ -6,11 +6,6 @@
             href="{{ route('server.advanced', ['server_uuid' => $server->uuid]) }}"><span class="menu-item-label">Advanced</span>
         </a>
     @endif
-    @if ($server->isFunctional() && !$server->isSwarm() && !$server->isBuildServer())
-        <a class="sub-menu-item {{ $activeMenu === 'sentinel' ? 'menu-item-active' : '' }}" {{ wireNavigate() }}
-            href="{{ route('server.sentinel', ['server_uuid' => $server->uuid]) }}"><span class="menu-item-label">Sentinel</span>
-        </a>
-    @endif
     <a class="sub-menu-item {{ $activeMenu === 'private-key' ? 'menu-item-active' : '' }}" {{ wireNavigate() }}
         href="{{ route('server.private-key', ['server_uuid' => $server->uuid]) }}"><span class="menu-item-label">Private Key</span>
     </a>
@@ -37,7 +32,7 @@
         <a class="sub-menu-item {{ $activeMenu === 'log-drains' ? 'menu-item-active' : '' }}" {{ wireNavigate() }}
             href="{{ route('server.log-drains', ['server_uuid' => $server->uuid]) }}"><span class="menu-item-label">Log Drains</span></a>
         <a class="sub-menu-item {{ $activeMenu === 'metrics' ? 'menu-item-active' : '' }}" {{ wireNavigate() }}
-            href="{{ route('server.charts', ['server_uuid' => $server->uuid]) }}"><span class="menu-item-label">Metrics</span></a>
+            href="{{ route('server.metrics', ['server_uuid' => $server->uuid]) }}"><span class="menu-item-label">Metrics</span></a>
     @endif
     @if (!$server->isBuildServer() && !$server->settings->is_cloudflare_tunnel)
         <a class="sub-menu-item {{ $activeMenu === 'swarm' ? 'menu-item-active' : '' }}" {{ wireNavigate() }}
diff --git a/resources/views/components/slide-over.blade.php b/resources/views/components/slide-over.blade.php
index 13769c7b6..114135463 100644
--- a/resources/views/components/slide-over.blade.php
+++ b/resources/views/components/slide-over.blade.php
@@ -32,11 +32,12 @@ class="flex flex-col h-full py-6 overflow-hidden border-l shadow-lg bg-neutral-5
                                 <div class="px-4 pb-4 sm:px-5">
                                     <div class="flex items-start justify-between pb-1">
                                         <h2 class="text-2xl leading-6" id="slide-over-title">
-                                            {{ $title }}</h2>
+                                            {{ $title }}
+                                        </h2>
                                         <div class="flex items-center h-auto ml-3">
                                             <button @click="slideOverOpen=false"
-                                                class="absolute top-0 right-0 z-30 flex items-center justify-center px-3 py-2 mt-4 mr-2 space-x-1 text-xs font-normal border-none rounded-sm">
-                                                <svg xmlns="http://www.w3.org/2000/svg" class="w-6 h-6" fill="none"
+                                                class="absolute cursor-pointer top-0 right-0 z-30 flex items-center justify-center w-8 h-8 mt-5 mr-5 rounded-full dark:text-white hover:bg-neutral-100 dark:hover:bg-coolgray-300 outline-0 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-coollabs dark:focus-visible:ring-warning focus-visible:ring-offset-2 dark:focus-visible:ring-offset-base">
+                                                <svg xmlns="http://www.w3.org/2000/svg" class="w-5 h-5" fill="none"
                                                     viewBox="0 0 24 24" stroke-width="1.5" stroke="currentColor">
                                                     <path stroke-linecap="round" stroke-linejoin="round"
                                                         d="M6 18L18 6M6 6l12 12"></path>
diff --git a/resources/views/components/status/index.blade.php b/resources/views/components/status/index.blade.php
index 8d959ce6e..b54e35bd5 100644
--- a/resources/views/components/status/index.blade.php
+++ b/resources/views/components/status/index.blade.php
@@ -2,7 +2,11 @@
     'title' => null,
     'lastDeploymentLink' => null,
     'resource' => null,
+    'showRefreshButton' => true,
 ])
+@php
+    $stoppedAfterRestartLimit = $resource && method_exists($resource, 'stoppedAfterRestartLimit') && $resource->stoppedAfterRestartLimit();
+@endphp
 <div class="flex flex-wrap items-center gap-1">
     @if (str($resource->status)->startsWith('running'))
         <x-status.running :status="$resource->status" :title="$title" :lastDeploymentLink="$lastDeploymentLink" />
@@ -13,13 +17,20 @@
     @else
         <x-status.stopped :status="$resource->status" />
     @endif
-    @if (isset($resource->restart_count) && $resource->restart_count > 0 && !str($resource->status)->startsWith('exited'))
+    @if (isset($resource->restart_count) && $resource->restart_count > 0 && (!str($resource->status)->startsWith('exited') || $stoppedAfterRestartLimit))
         <div class="flex items-center">
             <span class="text-xs dark:text-warning" title="Container has restarted {{ $resource->restart_count }} time{{ $resource->restart_count > 1 ? 's' : '' }}. Last restart: {{ $resource->last_restart_at?->diffForHumans() }}">
                 ({{ $resource->restart_count }}x restarts)
             </span>
         </div>
     @endif
+    @if ($stoppedAfterRestartLimit)
+        <div class="flex items-center">
+            <span class="text-xs dark:text-warning" title="Container has crashed and Coolify stopped it after {{ $resource->restart_count }} restart attempts.">
+                Stopped after reaching restart limit ({{ $resource->restart_count }}/{{ $resource->max_restart_count }}).
+            </span>
+        </div>
+    @endif
     @if (!str($resource->status)->contains('exited') && $showRefreshButton)
         <button wire:loading.remove.delay.shortest wire:target="manualCheckStatus" title="Refresh Status" wire:click='manualCheckStatus'
             class="dark:hover:fill-white fill-black dark:fill-warning">
diff --git a/resources/views/emails/application-restart-limit-reached.blade.php b/resources/views/emails/application-restart-limit-reached.blade.php
new file mode 100644
index 000000000..e5fa01c00
--- /dev/null
+++ b/resources/views/emails/application-restart-limit-reached.blade.php
@@ -0,0 +1,7 @@
+<x-emails.layout>
+{{ $name }} has been automatically stopped after {{ $restart_count }} crash restarts (limit: {{ $max_restart_count }}).
+
+The application appears to be in a crash loop. Please investigate the issue and redeploy when ready.
+
+[Check what is going on]({{ $resource_url }}).
+</x-emails.layout>
diff --git a/resources/views/livewire/destination/navbar.blade.php b/resources/views/livewire/destination/navbar.blade.php
new file mode 100644
index 000000000..4585e57a9
--- /dev/null
+++ b/resources/views/livewire/destination/navbar.blade.php
@@ -0,0 +1,14 @@
+@if ($destination->getMorphClass() === 'App\\Models\\StandaloneDocker')
+    <div class="navbar-main">
+        <nav class="flex shrink-0 gap-6 items-center whitespace-nowrap scrollbar min-h-10">
+            <a class="{{ request()->routeIs('destination.show') ? 'dark:text-white' : '' }}" {{ wireNavigate() }}
+                href="{{ route('destination.show', ['destination_uuid' => $destination->uuid]) }}">
+                General
+            </a>
+            <a class="{{ request()->routeIs('destination.resources') ? 'dark:text-white' : '' }}" {{ wireNavigate() }}
+                href="{{ route('destination.resources', ['destination_uuid' => $destination->uuid]) }}">
+                Resources
+            </a>
+        </nav>
+    </div>
+@endif
diff --git a/resources/views/livewire/destination/resources.blade.php b/resources/views/livewire/destination/resources.blade.php
new file mode 100644
index 000000000..8883cc021
--- /dev/null
+++ b/resources/views/livewire/destination/resources.blade.php
@@ -0,0 +1,53 @@
+<div>
+    <div class="flex items-center gap-2">
+        <h1>Destination</h1>
+    </div>
+    <div class="subtitle">Resources deployed to this Docker network.</div>
+
+    @include('livewire.destination.navbar', ['destination' => $destination])
+
+    <div class="pt-4" x-data="{ search: '' }">
+        @if (count($resources) === 0)
+            <div class="py-4 text-sm opacity-70">No resources are using this destination.</div>
+        @else
+            <x-forms.input placeholder="Search resources..." x-model="search" id="null" />
+            <div class="overflow-x-auto pt-4">
+                <div class="inline-block min-w-full">
+                    <div class="overflow-hidden">
+                        <table class="min-w-full">
+                            <thead>
+                                <tr>
+                                    <th class="px-5 py-3 text-xs font-medium text-left uppercase">Project</th>
+                                    <th class="px-5 py-3 text-xs font-medium text-left uppercase">Environment</th>
+                                    <th class="px-5 py-3 text-xs font-medium text-left uppercase">Name</th>
+                                    <th class="px-5 py-3 text-xs font-medium text-left uppercase">Type</th>
+                                </tr>
+                            </thead>
+                            <tbody class="divide-y">
+                                @foreach ($resources as $row)
+                                    <tr class="dark:hover:bg-coolgray-300 hover:bg-neutral-100"
+                                        wire:key="destination-resource-{{ $row['type'] }}-{{ $row['uuid'] }}"
+                                        x-show="search === '' || '{{ addslashes($row['search']) }}'.includes(search.toLowerCase())">
+                                        <td class="px-5 py-4 text-sm whitespace-nowrap">{{ $row['project'] }}</td>
+                                        <td class="px-5 py-4 text-sm whitespace-nowrap">{{ $row['environment'] }}</td>
+                                        <td class="px-5 py-4 text-sm whitespace-nowrap">
+                                            @if ($row['url'])
+                                                <a {{ wireNavigate() }} href="{{ $row['url'] }}">
+                                                    {{ $row['name'] }}
+                                                    <x-internal-link />
+                                                </a>
+                                            @else
+                                                <span>{{ $row['name'] }}</span>
+                                            @endif
+                                        </td>
+                                        <td class="px-5 py-4 text-sm whitespace-nowrap">{{ ucfirst($row['type']) }}</td>
+                                    </tr>
+                                @endforeach
+                            </tbody>
+                        </table>
+                    </div>
+                </div>
+            </div>
+        @endif
+    </div>
+</div>
diff --git a/resources/views/livewire/destination/show.blade.php b/resources/views/livewire/destination/show.blade.php
index 27260e920..77b7209b7 100644
--- a/resources/views/livewire/destination/show.blade.php
+++ b/resources/views/livewire/destination/show.blade.php
@@ -20,7 +20,9 @@
                 <x-deprecated-badge />
             </div>
         @endif
-        <div class="flex gap-2">
+        @include('livewire.destination.navbar', ['destination' => $destination])
+
+        <div class="flex gap-2 pt-4">
             <x-forms.input canGate="update" :canResource="$destination" id="name" label="Name" />
             <x-forms.input id="serverIp" label="Server IP" readonly />
             @if ($destination->getMorphClass() === 'App\Models\StandaloneDocker')
diff --git a/resources/views/livewire/project/application/advanced.blade.php b/resources/views/livewire/project/application/advanced.blade.php
index d6fcc2e4a..3bbb60a4d 100644
--- a/resources/views/livewire/project/application/advanced.blade.php
+++ b/resources/views/livewire/project/application/advanced.blade.php
@@ -101,6 +101,18 @@
                 />
                 <x-forms.button canGate="update" :canResource="$application" type="submit">Save</x-forms.button>
             </form>
+            <form class="flex items-end gap-2" wire:submit.prevent='saveMaxRestartCount'>
+                <x-forms.input
+                    type="number"
+                    min="0"
+                    helper="Maximum number of crash restarts before Coolify automatically stops the application and sends a notification. Set to 0 to disable the limit."
+                    id="maxRestartCount"
+                    label="Max Restart Count"
+                    canGate="update"
+                    :canResource="$application"
+                />
+                <x-forms.button canGate="update" :canResource="$application" type="submit">Save</x-forms.button>
+            </form>
             <h3 class="pt-4">Logs</h3>
             <x-forms.checkbox helper="Drain logs to your configured log drain endpoint in your Server settings."
                 instantSave id="isLogDrainEnabled" label="Drain Logs" canGate="update" :canResource="$application" />
diff --git a/resources/views/livewire/project/application/deployment/show.blade.php b/resources/views/livewire/project/application/deployment/show.blade.php
index 0f5fc3396..1e9b64386 100644
--- a/resources/views/livewire/project/application/deployment/show.blade.php
+++ b/resources/views/livewire/project/application/deployment/show.blade.php
@@ -115,10 +115,6 @@
             const range = selection.getRangeAt(0);
             return logsContainer.contains(range.commonAncestorContainer);
         },
-        decodeHtml(text) {
-            const doc = new DOMParser().parseFromString(text, 'text/html');
-            return doc.documentElement.textContent;
-        },
         highlightText(el, text, query) {
             if (this.hasActiveLogSelection()) return;
 
@@ -159,7 +155,7 @@
                 if (matches && query) count++;
 
                 if (textSpan) {
-                    const originalText = this.decodeHtml(textSpan.dataset.lineText || '');
+                    const originalText = textSpan.dataset.lineText || '';
                     if (!query) {
                         textSpan.textContent = originalText;
                     } else if (matches) {
@@ -186,8 +182,15 @@
         copyLogs() {
             const content = this.collectVisibleLogs();
             if (!content) return;
-            navigator.clipboard.writeText(content);
-            Livewire.dispatch('success', ['Logs copied to clipboard.']);
+            if (!navigator.clipboard?.writeText) {
+                Livewire.dispatch('error', ['Clipboard is not available. Please use HTTPS or localhost.']);
+                return;
+            }
+            navigator.clipboard?.writeText(content).then(() => {
+                Livewire.dispatch('success', ['Logs copied to clipboard.']);
+            }).catch(() => {
+                Livewire.dispatch('error', ['Failed to copy logs to clipboard.']);
+            });
         },
         downloadLogs() {
             const content = this.collectVisibleLogs();
@@ -433,14 +436,14 @@ class="text-gray-500 dark:text-gray-400 py-2">
                                     $lineContent = (isset($line['command']) && $line['command'] ? '[CMD]: ' : '') . trim($line['line']);
                                     $searchableContent = $line['timestamp'] . ' ' . $lineContent;
                                 @endphp
-                                <div data-log-line data-log-content="{{ htmlspecialchars($searchableContent) }}"
+                                <div data-log-line data-log-content="{{ $searchableContent }}"
                                     @class([
                                         'mt-2' => isset($line['command']) && $line['command'],
                                         'flex gap-2 log-line',
                                     ])>
                                     <span x-show="showTimestamps"
                                         class="shrink-0 text-gray-500">{{ $line['timestamp'] }}</span>
-                                    <span data-line-text="{{ htmlspecialchars($lineContent) }}"
+                                    <span data-line-text="{{ $lineContent }}"
                                         @class([
                                             'text-success dark:text-warning' => $line['hidden'],
                                             'text-red-500' => $line['stderr'],
diff --git a/resources/views/livewire/project/application/general.blade.php b/resources/views/livewire/project/application/general.blade.php
index e395a8a7d..190f4262a 100644
--- a/resources/views/livewire/project/application/general.blade.php
+++ b/resources/views/livewire/project/application/general.blade.php
@@ -12,6 +12,9 @@
                 <div>{{ $application->compose_parsing_version }}</div>
             @endif
             <x-forms.button canGate="update" :canResource="$application" type="submit">Save</x-forms.button>
+            <x-modal-input title="Resource Details" buttonTitle="Details">
+                <livewire:project.shared.resource-details :resource="$application" />
+            </x-modal-input>
             @if ($buildPack === 'dockercompose')
                 <x-forms.button canGate="update" :canResource="$application" wire:target='initLoadingCompose'
                     x-on:click="$wire.dispatch('loadCompose', false)">
@@ -497,6 +500,13 @@ class="flex items-start gap-2 p-4 mb-4 text-sm rounded-lg bg-blue-50 dark:bg-blu
                         </div>
                     @endif
                 @endif
+                @if ((empty($portsExposes) || $portsExposes === '0') && !empty($fqdn))
+                    <x-callout type="info" title="No ports exposed" class="mb-4">
+                        This application does not expose any ports and will not be reachable through the proxy or your domains.
+                        This behavior is normal for background workers, bots, or scheduled tasks.
+                        If your application needs to handle HTTP traffic, please specify the port(s) it listens on.
+                    </x-callout>
+                @endif
                 <div class="flex flex-col gap-2 xl:flex-row">
                     @if ($isStatic || $buildPack === 'static')
                         <x-forms.input id="portsExposes" label="Ports Exposes" readonly
@@ -507,7 +517,7 @@ class="flex items-start gap-2 p-4 mb-4 text-sm rounded-lg bg-blue-50 dark:bg-blu
                                 helper="Readonly labels are disabled. You can set the ports manually in the labels section."
                                 x-bind:disabled="!canUpdate" />
                         @else
-                            <x-forms.input placeholder="3000,3001" id="portsExposes" label="Ports Exposes" required
+                            <x-forms.input placeholder="3000,3001" id="portsExposes" label="Ports Exposes"
                                 helper="A comma separated list of ports your application uses. The first port will be used as default healthcheck port if nothing defined in the Healthcheck menu. Be sure to set this correctly."
                                 x-bind:disabled="!canUpdate" />
                         @endif
diff --git a/resources/views/livewire/project/application/heading.blade.php b/resources/views/livewire/project/application/heading.blade.php
index 6e27989bd..e5cf13178 100644
--- a/resources/views/livewire/project/application/heading.blade.php
+++ b/resources/views/livewire/project/application/heading.blade.php
@@ -15,7 +15,7 @@ class="scrollbar flex min-h-10 w-full flex-nowrap items-center gap-6 overflow-x-
                 href="{{ route('project.application.logs', $parameters) }}">
                 <div class="flex items-center gap-1">
                     Logs
-                    @if ($application->restart_count > 0 && !str($application->status)->startsWith('exited'))
+                    @if ($application->restart_count > 0 && (!str($application->status)->startsWith('exited') || $application->stoppedAfterRestartLimit()))
                         <svg class="w-4 h-4 dark:text-warning" viewBox="0 0 24 24" fill="currentColor" xmlns="http://www.w3.org/2000/svg" title="Container has restarted {{ $application->restart_count }} time{{ $application->restart_count > 1 ? 's' : '' }}">
                             <path d="M12 2L1 21h22L12 2zm0 4l7.53 13H4.47L12 6zm-1 5v4h2v-4h-2zm0 5v2h2v-2h-2z"/>
                         </svg>
diff --git a/resources/views/livewire/project/database/clickhouse/general.blade.php b/resources/views/livewire/project/database/clickhouse/general.blade.php
index 12e0ca381..d4ee9b8e3 100644
--- a/resources/views/livewire/project/database/clickhouse/general.blade.php
+++ b/resources/views/livewire/project/database/clickhouse/general.blade.php
@@ -5,6 +5,9 @@
             <x-forms.button type="submit" canGate="update" :canResource="$database">
                 Save
             </x-forms.button>
+            <x-modal-input title="Resource Details" buttonTitle="Details">
+                <livewire:project.shared.resource-details :resource="$database" />
+            </x-modal-input>
         </div>
         <div class="flex gap-2">
             <x-forms.input label="Name" id="name" canGate="update" :canResource="$database" />
diff --git a/resources/views/livewire/project/database/dragonfly/general.blade.php b/resources/views/livewire/project/database/dragonfly/general.blade.php
index f498acbd1..04ede2ea0 100644
--- a/resources/views/livewire/project/database/dragonfly/general.blade.php
+++ b/resources/views/livewire/project/database/dragonfly/general.blade.php
@@ -5,6 +5,9 @@
             <x-forms.button type="submit" canGate="update" :canResource="$database">
                 Save
             </x-forms.button>
+            <x-modal-input title="Resource Details" buttonTitle="Details">
+                <livewire:project.shared.resource-details :resource="$database" />
+            </x-modal-input>
         </div>
         <div class="flex gap-2">
             <x-forms.input label="Name" id="name" canGate="update" :canResource="$database" />
diff --git a/resources/views/livewire/project/database/keydb/general.blade.php b/resources/views/livewire/project/database/keydb/general.blade.php
index 78c36bca6..74c92bb61 100644
--- a/resources/views/livewire/project/database/keydb/general.blade.php
+++ b/resources/views/livewire/project/database/keydb/general.blade.php
@@ -5,6 +5,9 @@
             <x-forms.button type="submit" canGate="update" :canResource="$database">
                 Save
             </x-forms.button>
+            <x-modal-input title="Resource Details" buttonTitle="Details">
+                <livewire:project.shared.resource-details :resource="$database" />
+            </x-modal-input>
         </div>
         <div class="flex gap-2">
             <x-forms.input label="Name" id="name" canGate="update" :canResource="$database" />
diff --git a/resources/views/livewire/project/database/mariadb/general.blade.php b/resources/views/livewire/project/database/mariadb/general.blade.php
index 9a6f31088..2eb79cc2d 100644
--- a/resources/views/livewire/project/database/mariadb/general.blade.php
+++ b/resources/views/livewire/project/database/mariadb/general.blade.php
@@ -5,6 +5,9 @@
             <x-forms.button type="submit" canGate="update" :canResource="$database">
                 Save
             </x-forms.button>
+            <x-modal-input title="Resource Details" buttonTitle="Details">
+                <livewire:project.shared.resource-details :resource="$database" />
+            </x-modal-input>
         </div>
         <div class="flex gap-2">
             <x-forms.input label="Name" id="name" canGate="update" :canResource="$database" />
diff --git a/resources/views/livewire/project/database/mongodb/general.blade.php b/resources/views/livewire/project/database/mongodb/general.blade.php
index 9999faf2b..f0684f2b0 100644
--- a/resources/views/livewire/project/database/mongodb/general.blade.php
+++ b/resources/views/livewire/project/database/mongodb/general.blade.php
@@ -5,6 +5,9 @@
             <x-forms.button type="submit" canGate="update" :canResource="$database">
                 Save
             </x-forms.button>
+            <x-modal-input title="Resource Details" buttonTitle="Details">
+                <livewire:project.shared.resource-details :resource="$database" />
+            </x-modal-input>
         </div>
         <div class="flex gap-2">
             <x-forms.input label="Name" id="name" canGate="update" :canResource="$database" />
diff --git a/resources/views/livewire/project/database/mysql/general.blade.php b/resources/views/livewire/project/database/mysql/general.blade.php
index 9f90ee0ed..0afd9db19 100644
--- a/resources/views/livewire/project/database/mysql/general.blade.php
+++ b/resources/views/livewire/project/database/mysql/general.blade.php
@@ -5,6 +5,9 @@
             <x-forms.button type="submit">
                 Save
             </x-forms.button>
+            <x-modal-input title="Resource Details" buttonTitle="Details">
+                <livewire:project.shared.resource-details :resource="$database" />
+            </x-modal-input>
         </div>
         <div class="flex gap-2">
             <x-forms.input label="Name" id="name" canGate="update" :canResource="$database" />
diff --git a/resources/views/livewire/project/database/postgresql/general.blade.php b/resources/views/livewire/project/database/postgresql/general.blade.php
index cacc9f8b1..2f0b14e84 100644
--- a/resources/views/livewire/project/database/postgresql/general.blade.php
+++ b/resources/views/livewire/project/database/postgresql/general.blade.php
@@ -19,6 +19,9 @@
             <x-forms.button type="submit" canGate="update" :canResource="$database">
                 Save
             </x-forms.button>
+            <x-modal-input title="Resource Details" buttonTitle="Details">
+                <livewire:project.shared.resource-details :resource="$database" />
+            </x-modal-input>
         </div>
         <div class="flex flex-wrap gap-2 sm:flex-nowrap">
             <x-forms.input label="Name" id="name" canGate="update" :canResource="$database" />
diff --git a/resources/views/livewire/project/database/redis/general.blade.php b/resources/views/livewire/project/database/redis/general.blade.php
index 78de3479d..9d317f6bf 100644
--- a/resources/views/livewire/project/database/redis/general.blade.php
+++ b/resources/views/livewire/project/database/redis/general.blade.php
@@ -5,6 +5,9 @@
             <x-forms.button type="submit" canGate="update" :canResource="$database">
                 Save
             </x-forms.button>
+            <x-modal-input title="Resource Details" buttonTitle="Details">
+                <livewire:project.shared.resource-details :resource="$database" />
+            </x-modal-input>
         </div>
         <div class="flex gap-2">
             <x-forms.input label="Name" id="name" canGate="update" :canResource="$database" />
diff --git a/resources/views/livewire/project/new/select.blade.php b/resources/views/livewire/project/new/select.blade.php
index c5482d9f7..debe3326f 100644
--- a/resources/views/livewire/project/new/select.blade.php
+++ b/resources/views/livewire/project/new/select.blade.php
@@ -138,9 +138,14 @@ class="w-full h-full p-2 transition-all duration-200 dark:bg-white/10 bg-black/1
                     </div>
                 </div>
                 <div x-show="filteredServices.length > 0" class="mt-8">
-                    <div class="flex items-center gap-4" x-init="loadResources">
+                    <div class="flex flex-wrap items-center gap-4" x-init="loadResources">
                         <h2>Services</h2>
                         <x-forms.button x-on:click="loadResources">Reload List</x-forms.button>
+                        <div x-show="serviceTemplatesLastUpdated"
+                            class="text-xs text-neutral-500 dark:text-neutral-400">
+                            Last Updated on Service Templates:
+                            <span x-text="serviceTemplatesLastUpdated"></span>
+                        </div>
                     </div>
                     <x-callout type="info" title="Trademarks Policy" class="mt-4 mb-6">
                         The respective trademarks mentioned here are owned by the respective companies, and use of them
@@ -154,7 +159,14 @@ class="w-full h-full p-2 transition-all duration-200 dark:bg-white/10 bg-black/1
                                 <x-resource-view>
                                     <x-slot:title>
                                         <template x-if="service.name">
-                                            <span x-text="service.name"></span>
+                                            <div>
+                                                <span x-text="service.name"></span>
+                                                <template x-if="service.templateLastUpdated">
+                                                    <div class="mt-1 text-[0.7rem] font-normal text-neutral-500 dark:text-neutral-500">
+                                                        Updated: <span x-text="service.templateLastUpdated"></span>
+                                                    </div>
+                                                </template>
+                                            </div>
                                         </template>
                                     </x-slot>
                                     <x-slot:description>
@@ -237,6 +249,7 @@ function searchResources() {
                         isSticky: false,
                         selecting: false,
                         services: [],
+                        serviceTemplatesLastUpdated: null,
                         gitBasedApplications: [],
                         dockerBasedApplications: [],
                         databases: [],
@@ -251,12 +264,14 @@ function searchResources() {
                             this.loading = true;
                             const {
                                 services,
+                                serviceTemplatesLastUpdated,
                                 categories,
                                 gitBasedApplications,
                                 dockerBasedApplications,
                                 databases
                             } = await this.$wire.loadServices();
                             this.services = services;
+                            this.serviceTemplatesLastUpdated = serviceTemplatesLastUpdated;
                             this.categories = categories || [];
                             this.gitBasedApplications = gitBasedApplications;
                             this.dockerBasedApplications = dockerBasedApplications;
diff --git a/resources/views/livewire/project/service/stack-form.blade.php b/resources/views/livewire/project/service/stack-form.blade.php
index 9cb891af7..37e5f5924 100644
--- a/resources/views/livewire/project/service/stack-form.blade.php
+++ b/resources/views/livewire/project/service/stack-form.blade.php
@@ -12,6 +12,9 @@
                     <livewire:project.service.edit-compose serviceId="{{ $service->id }}" />
                 </x-modal-input>
             @endcan
+            <x-modal-input title="Resource Details" buttonTitle="Details">
+                <livewire:project.shared.resource-details :resource="$service" />
+            </x-modal-input>
         </div>
         <div>Configuration</div>
     </div>
diff --git a/resources/views/livewire/project/shared/configuration-checker.blade.php b/resources/views/livewire/project/shared/configuration-checker.blade.php
index 2c4440dfb..19974c587 100644
--- a/resources/views/livewire/project/shared/configuration-checker.blade.php
+++ b/resources/views/livewire/project/shared/configuration-checker.blade.php
@@ -1,6 +1,6 @@
 <div>
     @if ($isConfigurationChanged && !is_null($resource->config_hash) && !$resource->isExited())
-        <div x-data="{ configurationDiffModalOpen: false }">
+        <div x-data="{ configurationDiffModalOpen: false, expandedRows: {} }">
             <x-popup-small>
                 <x-slot:title>
                     The latest configuration has not been applied
diff --git a/resources/views/livewire/project/shared/environment-variable/all.blade.php b/resources/views/livewire/project/shared/environment-variable/all.blade.php
index 2ae3ad166..991327265 100644
--- a/resources/views/livewire/project/shared/environment-variable/all.blade.php
+++ b/resources/views/livewire/project/shared/environment-variable/all.blade.php
@@ -43,38 +43,69 @@
         @endif
     </div>
     @if ($view === 'normal')
-        <div>
-            <h3>Production Environment Variables</h3>
-            <div>Environment (secrets) variables for Production.</div>
-        </div>
-        @forelse ($this->environmentVariables as $env)
-            <livewire:project.shared.environment-variable.show wire:key="environment-{{ $env->id }}" :env="$env"
-                :type="$resource->type()" />
-        @empty
-            <div>No environment variables found.</div>
-        @endforelse
-        @if (($resource->type() === 'service' || $resource?->build_pack === 'dockercompose') && $this->hardcodedEnvironmentVariables->isNotEmpty())
-            @foreach ($this->hardcodedEnvironmentVariables as $index => $env)
-                <livewire:project.shared.environment-variable.show-hardcoded
-                    wire:key="hardcoded-prod-{{ $env['key'] }}-{{ $env['service_name'] ?? 'default' }}-{{ $index }}"
-                    :env="$env" />
-            @endforeach
-        @endif
-        @if ($resource->type() === 'application' && $resource->environment_variables_preview->count() > 0 && $showPreview)
-            <div>
-                <h3>Preview Deployments Environment Variables</h3>
-                <div>Environment (secrets) variables for Preview Deployments.</div>
+        <div class="w-full md:w-96">
+            <div class="relative">
+                <input type="search" placeholder="Search" aria-label="Search environment variables"
+                    wire:model.live.debounce.300ms="search" class="w-full input pl-10" />
+                <div class="absolute inset-y-0 left-0 flex items-center pl-3 pointer-events-none">
+                    <div class="relative w-4 h-4">
+                        <svg wire:loading.remove wire:target="search" aria-hidden="true"
+                            class="absolute inset-0 w-4 h-4 dark:text-neutral-400" fill="none" stroke="currentColor"
+                            viewBox="0 0 24 24">
+                            <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2"
+                                d="M21 21l-6-6m2-5a7 7 0 11-14 0 7 7 0 0114 0z" />
+                        </svg>
+                        <svg wire:loading wire:target="search" aria-hidden="true"
+                            class="absolute inset-0 w-4 h-4 text-coollabs dark:text-warning animate-spin" fill="none"
+                            viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg">
+                            <circle class="opacity-25" cx="12" cy="12" r="10" stroke="currentColor"
+                                stroke-width="4" />
+                            <path class="opacity-75" fill="currentColor"
+                                d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z" />
+                        </svg>
+                    </div>
+                </div>
             </div>
-            @foreach ($this->environmentVariablesPreview as $env)
-                <livewire:project.shared.environment-variable.show wire:key="environment-{{ $env->id }}" :env="$env"
-                    :type="$resource->type()" />
-            @endforeach
-            @if (($resource->type() === 'service' || $resource?->build_pack === 'dockercompose') && $this->hardcodedEnvironmentVariablesPreview->isNotEmpty())
-                @foreach ($this->hardcodedEnvironmentVariablesPreview as $index => $env)
-                    <livewire:project.shared.environment-variable.show-hardcoded
-                        wire:key="hardcoded-preview-{{ $env['key'] }}-{{ $env['service_name'] ?? 'default' }}-{{ $index }}"
-                        :env="$env" />
+        </div>
+        @if ($this->isSearchActive && ! $this->hasEnvironmentVariables)
+            <div>No environment variables found.</div>
+        @else
+            @if ($this->environmentVariables->isNotEmpty() || $this->hardcodedEnvironmentVariables->isNotEmpty())
+                <div>
+                    <h3>Production Environment Variables</h3>
+                    <div>Environment (secrets) variables for Production.</div>
+                </div>
+                @foreach ($this->environmentVariables as $env)
+                    <livewire:project.shared.environment-variable.show wire:key="environment-{{ $env->id }}" :env="$env"
+                        :type="$resource->type()" />
                 @endforeach
+                @if (($resource->type() === 'service' || $resource?->build_pack === 'dockercompose') && $this->hardcodedEnvironmentVariables->isNotEmpty())
+                    @foreach ($this->hardcodedEnvironmentVariables as $index => $env)
+                        <livewire:project.shared.environment-variable.show-hardcoded
+                            wire:key="hardcoded-prod-{{ $env['key'] }}-{{ $env['service_name'] ?? 'default' }}-{{ $index }}" :env="$env" />
+                    @endforeach
+                @endif
+            @endif
+            @if (
+                $resource->type() === 'application' &&
+                    $showPreview &&
+                    ($this->environmentVariablesPreview->isNotEmpty() || $this->hardcodedEnvironmentVariablesPreview->isNotEmpty())
+            )
+                <div>
+                    <h3>Preview Deployments Environment Variables</h3>
+                    <div>Environment (secrets) variables for Preview Deployments.</div>
+                </div>
+                @foreach ($this->environmentVariablesPreview as $env)
+                    <livewire:project.shared.environment-variable.show wire:key="environment-{{ $env->id }}" :env="$env"
+                        :type="$resource->type()" />
+                @endforeach
+                @if (($resource->type() === 'service' || $resource?->build_pack === 'dockercompose') && $this->hardcodedEnvironmentVariablesPreview->isNotEmpty())
+                    @foreach ($this->hardcodedEnvironmentVariablesPreview as $index => $env)
+                        <livewire:project.shared.environment-variable.show-hardcoded
+                            wire:key="hardcoded-preview-{{ $env['key'] }}-{{ $env['service_name'] ?? 'default' }}-{{ $index }}"
+                            :env="$env" />
+                    @endforeach
+                @endif
             @endif
         @endif
     @else
@@ -88,8 +119,9 @@
                     label="Production Environment Variables"></x-forms.textarea>
 
                 @if ($showPreview)
-                    <x-forms.textarea rows="10" class="whitespace-pre-wrap font-sans" label="Preview Deployments Environment Variables"
-                        id="variablesPreview" wire:model="variablesPreview"></x-forms.textarea>
+                    <x-forms.textarea rows="10" class="whitespace-pre-wrap font-sans"
+                        label="Preview Deployments Environment Variables" id="variablesPreview"
+                        wire:model="variablesPreview"></x-forms.textarea>
                 @endif
 
                 <x-forms.button type="submit" class="btn btn-primary">Save All Environment Variables</x-forms.button>
@@ -98,8 +130,9 @@
                     label="Production Environment Variables" disabled></x-forms.textarea>
 
                 @if ($showPreview)
-                    <x-forms.textarea rows="10" class="whitespace-pre-wrap font-sans" label="Preview Deployments Environment Variables"
-                        id="variablesPreview" wire:model="variablesPreview" disabled></x-forms.textarea>
+                    <x-forms.textarea rows="10" class="whitespace-pre-wrap font-sans"
+                        label="Preview Deployments Environment Variables" id="variablesPreview" wire:model="variablesPreview"
+                        disabled></x-forms.textarea>
                 @endif
             @endcan
         </form>
diff --git a/resources/views/livewire/project/shared/get-logs.blade.php b/resources/views/livewire/project/shared/get-logs.blade.php
index 230a2c22a..39938c4df 100644
--- a/resources/views/livewire/project/shared/get-logs.blade.php
+++ b/resources/views/livewire/project/shared/get-logs.blade.php
@@ -139,10 +139,6 @@
             const range = selection.getRangeAt(0);
             return logsContainer.contains(range.commonAncestorContainer);
         },
-        decodeHtml(text) {
-            const doc = new DOMParser().parseFromString(text, 'text/html');
-            return doc.documentElement.textContent;
-        },
         applySearch() {
             const logs = document.getElementById('logs');
             if (!logs) return;
@@ -163,7 +159,7 @@
 
                 // Update highlighting
                 if (textSpan) {
-                    const originalText = this.decodeHtml(textSpan.dataset.lineText || '');
+                    const originalText = textSpan.dataset.lineText || '';
                     if (!query) {
                         textSpan.textContent = originalText;
                     } else if (matches) {
@@ -346,8 +342,17 @@ class="p-1 text-gray-500 hover:text-gray-700 dark:text-gray-400 dark:hover:text-
                         <button
                             x-on:click="
                                 $wire.copyLogs().then(logs => {
-                                    navigator.clipboard.writeText(logs);
-                                    Livewire.dispatch('success', ['Logs copied to clipboard.']);
+                                    if (!navigator.clipboard?.writeText) {
+                                        Livewire.dispatch('error', ['Clipboard is not available. Please use HTTPS or localhost.']);
+                                        return;
+                                    }
+                                    navigator.clipboard.writeText(logs).then(() => {
+                                        Livewire.dispatch('success', ['Logs copied to clipboard.']);
+                                    }).catch(() => {
+                                        Livewire.dispatch('error', ['Failed to copy logs to clipboard.']);
+                                    });
+                                }).catch(() => {
+                                    Livewire.dispatch('error', ['Failed to prepare logs for clipboard.']);
                                 });
                             "
                             title="Copy Logs"
@@ -523,20 +528,19 @@ class="text-gray-500 dark:text-gray-400 py-2">
                                     // Parse timestamp from log line (ISO 8601 format: 2025-12-04T11:48:39.136764033Z)
                                     $timestamp = '';
                                     $logContent = $line;
-                                    if (preg_match('/^(\d{4})-(\d{2})-(\d{2})T(\d{2}:\d{2}:\d{2})(?:\.(\d+))?Z?\s(.*)$/', $line, $matches)) {
-                                        $year = $matches[1];
-                                        $month = $matches[2];
-                                        $day = $matches[3];
-                                        $time = $matches[4];
-                                        $microseconds = isset($matches[5]) ? substr($matches[5], 0, 6) : '000000';
-                                        $logContent = $matches[6];
+                                    if (preg_match('/^(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2})(?:\.(\d+))?Z?\s(.*)$/', $line, $matches)) {
+                                        $microseconds = isset($matches[2]) ? substr($matches[2], 0, 6) : '000000';
+                                        $logContent = $matches[3];
 
-                                        // Convert month number to abbreviated name
-                                        $monthNames = ['Jan', 'Feb', 'Mar', 'Apr', 'May', 'Jun', 'Jul', 'Aug', 'Sep', 'Oct', 'Nov', 'Dec'];
-                                        $monthName = $monthNames[(int)$month - 1] ?? $month;
-
-                                        // Format for display: 2025-Dec-04 09:44:58
-                                        $timestamp = "{$year}-{$monthName}-{$day} {$time}";
+                                        // Convert UTC Docker timestamp to server timezone for display
+                                        $carbonTs = \Carbon\Carbon::parse($matches[1], 'UTC');
+                                        $serverTz = getServerTimezone($server);
+                                        try {
+                                            $carbonTs->setTimezone($serverTz);
+                                        } catch (\Exception) {
+                                            // keep UTC
+                                        }
+                                        $timestamp = $carbonTs->format('Y-M-d H:i:s');
                                         // Include microseconds in key for uniqueness
                                         $lineKey = "{$timestamp}.{$microseconds}";
                                     }
diff --git a/resources/views/livewire/project/shared/metrics.blade.php b/resources/views/livewire/project/shared/metrics.blade.php
index 728f7fef4..e86a86226 100644
--- a/resources/views/livewire/project/shared/metrics.blade.php
+++ b/resources/views/livewire/project/shared/metrics.blade.php
@@ -5,13 +5,19 @@
     <div class="pb-4">Basic metrics for your application container.</div>
     <div>
         @if ($resource->getMorphClass() === 'App\Models\Application' && $resource->build_pack === 'dockercompose')
-            <div class="alert alert-warning">Metrics are not available for Docker Compose applications yet!</div>
+            <x-callout type="warning" title="Not Available">
+                Metrics are not available for Docker Compose applications yet!
+            </x-callout>
         @elseif(!$resource->destination->server->isMetricsEnabled())
-            <div class="alert alert-warning pb-1">Metrics are only available for servers with Sentinel & Metrics enabled!</div>
-            <div>Go to <a class="underline dark:text-white" href="{{ route('server.show', $resource->destination->server->uuid) }}/sentinel" {{ wireNavigate() }}>Server settings</a> to enable it.</div>
+            <x-callout type="info" title="Metrics Not Enabled">
+                Metrics are only available for servers with Sentinel & Metrics enabled.
+                Go to <a class="underline font-semibold" href="{{ route('server.metrics', ['server_uuid' => $resource->destination->server->uuid]) }}" {{ wireNavigate() }}>Server Metrics</a> to enable it.
+            </x-callout>
         @else
             @if (!str($resource->status)->contains('running'))
-                <div class="alert alert-warning">Metrics are only available when the application container is running!</div>
+                <x-callout type="warning" title="Container Not Running">
+                    Metrics are only available when the application container is running!
+                </x-callout>
             @else
                 <div>
                 <x-forms.select label="Interval" wire:change="setInterval" id="interval">
diff --git a/resources/views/livewire/project/shared/resource-details.blade.php b/resources/views/livewire/project/shared/resource-details.blade.php
new file mode 100644
index 000000000..3be82da12
--- /dev/null
+++ b/resources/views/livewire/project/shared/resource-details.blade.php
@@ -0,0 +1,57 @@
+<div class="w-full max-h-[70vh] overflow-y-auto pr-1 -mt-4">
+    <div class="pb-4 text-sm dark:text-neutral-400">Identifiers for this resource. Read-only</div>
+
+    <div class="flex flex-col gap-6">
+        <div>
+            <h3>Resource</h3>
+            <div class="pt-2 grid grid-cols-1 gap-3 md:grid-cols-2">
+                <x-forms.copy-button label="Name" :text="$resource->name ?? ''" />
+                <x-forms.copy-button label="UUID" :text="$resource->uuid ?? ''" />
+            </div>
+        </div>
+
+        @if ($environment_uuid)
+            <div>
+                <h3>Environment</h3>
+                <div class="pt-2 grid grid-cols-1 gap-3 md:grid-cols-2">
+                    <x-forms.copy-button label="Name" :text="$environment_name ?? ''" />
+                    <x-forms.copy-button label="UUID" :text="$environment_uuid" />
+                </div>
+            </div>
+        @endif
+
+        @if ($project_uuid)
+            <div>
+                <h3>Project</h3>
+                <div class="pt-2 grid grid-cols-1 gap-3 md:grid-cols-2">
+                    <x-forms.copy-button label="Name" :text="$project_name ?? ''" />
+                    <x-forms.copy-button label="UUID" :text="$project_uuid" />
+                </div>
+            </div>
+        @endif
+
+        @if ($server_uuid)
+            <div>
+                <h3>Server</h3>
+                <div class="pt-2 grid grid-cols-1 gap-3 md:grid-cols-2">
+                    <x-forms.copy-button label="Name" :text="$server_name ?? ''" />
+                    <x-forms.copy-button label="UUID" :text="$server_uuid" />
+                </div>
+            </div>
+        @endif
+
+        @if (! empty($stack_applications) || ! empty($stack_databases))
+            <div>
+                <h3>Stack Sub-Resources</h3>
+                <div class="pt-2 grid grid-cols-1 gap-3 md:grid-cols-2">
+                    @foreach ($stack_applications as $item)
+                        <x-forms.copy-button :label="'Application — ' . $item['name']" :text="$item['uuid']" />
+                    @endforeach
+                    @foreach ($stack_databases as $item)
+                        <x-forms.copy-button :label="'Database — ' . $item['name']" :text="$item['uuid']" />
+                    @endforeach
+                </div>
+            </div>
+        @endif
+    </div>
+</div>
diff --git a/resources/views/livewire/server/charts.blade.php b/resources/views/livewire/server/charts.blade.php
index 51953ab9a..0acb79b93 100644
--- a/resources/views/livewire/server/charts.blade.php
+++ b/resources/views/livewire/server/charts.blade.php
@@ -6,7 +6,18 @@
     <div class="flex flex-col h-full gap-8 sm:flex-row">
         <x-server.sidebar :server="$server" activeMenu="metrics" />
         <div class="w-full">
-            <h2>Metrics</h2>
+            <div class="flex items-center gap-2">
+                <h2>Metrics</h2>
+                @if ($server->isMetricsEnabled())
+                    <x-forms.button canGate="update" :canResource="$server" wire:click='toggleMetrics'>
+                        Disable Metrics
+                    </x-forms.button>
+                @elseif ($server->isSentinelEnabled())
+                    <x-forms.button canGate="update" :canResource="$server" isHighlighted wire:click='toggleMetrics'>
+                        Enable Metrics
+                    </x-forms.button>
+                @endif
+            </div>
             <div class="pb-4">Basic metrics for your server.</div>
             @if ($server->isMetricsEnabled())
                 <div @if ($poll) wire:poll.5000ms='pollData' @endif x-init="$wire.loadData()">
@@ -288,8 +299,16 @@
                     </div>
                 </div>
             @else
-                <div>Metrics are disabled for this server. Enable them in <a class="underline dark:text-white"
-                        href="{{ route('server.show', ['server_uuid' => $server->uuid]) }}/sentinel" {{ wireNavigate() }}>Sentinel</a> settings.</div>
+                @if ($server->isSentinelEnabled())
+                    <x-callout type="info" title="Metrics Disabled">
+                        Metrics are disabled for this server. Click "Enable Metrics" above to start collecting metrics.
+                    </x-callout>
+                @else
+                    <x-callout type="info" title="Sentinel Required">
+                        Metrics require Sentinel to be enabled.
+                        Please <a class="underline font-semibold" href="{{ route('server.sentinel', ['server_uuid' => $server->uuid]) }}" {{ wireNavigate() }}>enable Sentinel</a> first.
+                    </x-callout>
+                @endif
             @endif
         </div>
     </div>
diff --git a/resources/views/livewire/server/navbar.blade.php b/resources/views/livewire/server/navbar.blade.php
index 413f0ee57..fd97fd9ca 100644
--- a/resources/views/livewire/server/navbar.blade.php
+++ b/resources/views/livewire/server/navbar.blade.php
@@ -58,6 +58,17 @@ class="mx-1 dark:hover:fill-white fill-black dark:fill-warning">
                 </div>
             </div>
         @endif
+        @if ($server->isSentinelEnabled())
+            <div class="flex">
+                <div class="flex items-center">
+                    @if ($server->isSentinelLive())
+                        <x-status.running status="Sentinel In Sync" noLoading />
+                    @else
+                        <x-status.stopped status="Sentinel Out of Sync" noLoading />
+                    @endif
+                </div>
+            </div>
+        @endif
     </div>
     <div class="subtitle">{{ data_get($server, 'name') }}</div>
     <div class="navbar-main">
@@ -70,7 +81,7 @@ class="flex items-center gap-6 overflow-x-scroll sm:overflow-x-hidden scrollbar
             </a>
 
             @if (!$server->isSwarmWorker() && !$server->settings->is_build_server)
-                        <a class="{{ request()->routeIs('server.proxy') ? 'dark:text-white' : '' }} flex items-center gap-1" href="{{ route('server.proxy', [
+                        <a class="{{ request()->routeIs('server.proxy') || request()->routeIs('server.proxy.*') ? 'dark:text-white' : '' }} flex items-center gap-1" href="{{ route('server.proxy', [
                     'server_uuid' => data_get($server, 'uuid'),
                 ]) }}" {{ wireNavigate() }}>
                             Proxy
@@ -82,6 +93,19 @@ class="flex items-center gap-6 overflow-x-scroll sm:overflow-x-hidden scrollbar
                             @endif
                         </a>
             @endif
+            @if ($server->isFunctional() && !$server->isSwarm() && !$server->settings->is_build_server)
+                        <a class="{{ request()->routeIs('server.sentinel') || request()->routeIs('server.sentinel.*') ? 'dark:text-white' : '' }} flex items-center gap-1" href="{{ route('server.sentinel', [
+                    'server_uuid' => data_get($server, 'uuid'),
+                ]) }}" {{ wireNavigate() }}>
+                            Sentinel
+                            @if ($server->isSentinelEnabled() && !$server->isSentinelLive())
+                                <svg class="w-4 h-4 text-warning" viewBox="0 0 256 256" xmlns="http://www.w3.org/2000/svg">
+                                    <path fill="currentColor"
+                                        d="M236.8 188.09L149.35 36.22a24.76 24.76 0 0 0-42.7 0L19.2 188.09a23.51 23.51 0 0 0 0 23.72A24.35 24.35 0 0 0 40.55 224h174.9a24.35 24.35 0 0 0 21.33-12.19a23.51 23.51 0 0 0 .02-23.72m-13.87 15.71a8.5 8.5 0 0 1-7.48 4.2H40.55a8.5 8.5 0 0 1-7.48-4.2a7.59 7.59 0 0 1 0-7.72l87.45-151.87a8.75 8.75 0 0 1 15 0l87.45 151.87a7.59 7.59 0 0 1-.04 7.72M120 144v-40a8 8 0 0 1 16 0v40a8 8 0 0 1-16 0m20 36a12 12 0 1 1-12-12a12 12 0 0 1 12 12" />
+                                </svg>
+                            @endif
+                        </a>
+            @endif
             <a class="{{ request()->routeIs('server.resources') ? 'dark:text-white' : '' }}" href="{{ route('server.resources', [
     'server_uuid' => data_get($server, 'uuid'),
 ]) }}" {{ wireNavigate() }}>
diff --git a/resources/views/livewire/server/sentinel.blade.php b/resources/views/livewire/server/sentinel.blade.php
index 27a6d7eed..9ba361662 100644
--- a/resources/views/livewire/server/sentinel.blade.php
+++ b/resources/views/livewire/server/sentinel.blade.php
@@ -1,111 +1,73 @@
 <div>
-    <x-slot:title>
-        {{ data_get_str($server, 'name')->limit(10) }} > Sentinel | Coolify
-    </x-slot>
-    <livewire:server.navbar :server="$server" />
-    <div class="flex flex-col h-full gap-8 sm:flex-row">
-        <x-server.sidebar :server="$server" activeMenu="sentinel" />
-        <div class="w-full">
-            <form wire:submit.prevent='submit'>
-                <div class="flex gap-2 items-center pb-2">
-                    <h2>Sentinel</h2>
-                    <x-helper helper="Sentinel reports your server's & container's health and collects metrics." />
-                    @if ($server->isSentinelEnabled())
-                        <div class="flex gap-2 items-center">
-                            @if ($server->isSentinelLive())
-                                <x-status.running status="In sync" noLoading title="{{ $sentinelUpdatedAt }}" />
-                                <x-forms.button type="submit" canGate="update" :canResource="$server">Save</x-forms.button>
-                                <x-forms.button wire:click='restartSentinel' canGate="update" :canResource="$server">Restart</x-forms.button>
-                                <x-slide-over fullScreen>
-                                    <x-slot:title>Sentinel Logs</x-slot:title>
-                                    <x-slot:content>
-                                        <livewire:project.shared.get-logs :server="$server"
-                                            container="coolify-sentinel" displayName="Sentinel" :collapsible="false"
-                                            lazy />
-                                    </x-slot:content>
-                                    <x-forms.button @click="slideOverOpen=true">Logs</x-forms.button>
-                                </x-slide-over>
-                            @else
-                                <x-status.stopped status="Out of sync" noLoading
-                                    title="{{ $sentinelUpdatedAt }}" />
-                                <x-forms.button type="submit" canGate="update" :canResource="$server">Save</x-forms.button>
-                                <x-forms.button wire:click='restartSentinel' canGate="update" :canResource="$server">Sync</x-forms.button>
-                                <x-slide-over fullScreen>
-                                    <x-slot:title>Sentinel Logs</x-slot:title>
-                                    <x-slot:content>
-                                        <livewire:project.shared.get-logs :server="$server"
-                                            container="coolify-sentinel" displayName="Sentinel" :collapsible="false"
-                                            lazy />
-                                    </x-slot:content>
-                                    <x-forms.button @click="slideOverOpen=true">Logs</x-forms.button>
-                                </x-slide-over>
-                            @endif
-                        </div>
-                    @endif
+    <form wire:submit.prevent='submit'>
+        <div class="flex gap-2 items-center pb-2">
+            <h2>Sentinel</h2>
+            <x-helper helper="Sentinel reports your server's & container's health and collects metrics." />
+            @if (!$isSentinelEnabled)
+                <x-forms.button canGate="update" :canResource="$server" isHighlighted wire:click="toggleSentinel">Enable Sentinel</x-forms.button>
+            @else
+                <div class="flex gap-2 items-center">
+                    <x-forms.button type="submit" canGate="update" :canResource="$server">Save</x-forms.button>
+                    <x-forms.button wire:click='restartSentinel' canGate="update" :canResource="$server">
+                        {{ $server->isSentinelLive() ? 'Restart' : 'Sync' }}
+                    </x-forms.button>
+                    <x-forms.button canGate="update" :canResource="$server" wire:click="toggleSentinel">Disable Sentinel</x-forms.button>
                 </div>
-                <div class="flex flex-col gap-2">
-                    <div class="w-full sm:w-96">
-                        <x-forms.checkbox canGate="update" :canResource="$server" wire:model.live="isSentinelEnabled"
-                            label="Enable Sentinel" />
-                        @if ($server->isSentinelEnabled())
-                            @if (isDev())
-                                <x-forms.checkbox canGate="update" :canResource="$server" id="isSentinelDebugEnabled"
-                                    label="Enable Sentinel (with debug)" instantSave />
-                            @endif
-                            <x-forms.checkbox canGate="update" :canResource="$server" instantSave
-                                id="isMetricsEnabled" label="Enable Metrics" />
-                        @else
-                            @if (isDev())
-                                <x-forms.checkbox id="isSentinelDebugEnabled" label="Enable Sentinel (with debug)"
-                                    disabled instantSave />
-                            @endif
-                            <x-forms.checkbox instantSave disabled id="isMetricsEnabled"
-                                label="Enable Metrics (enable Sentinel first)" />
-                        @endif
-                    </div>
-                    @if (isDev() && $server->isSentinelEnabled())
-                        <div class="pt-4" x-data="{
-                            customImage: localStorage.getItem('sentinel_custom_docker_image_{{ $server->uuid }}') || '',
-                            saveCustomImage() {
-                                localStorage.setItem('sentinel_custom_docker_image_{{ $server->uuid }}', this.customImage);
-                                $wire.set('sentinelCustomDockerImage', this.customImage);
-                            }
-                        }" x-init="$wire.set('sentinelCustomDockerImage', customImage)">
-                            <x-forms.input x-model="customImage" @input.debounce.500ms="saveCustomImage()"
-                                placeholder="e.g., sentinel:latest or myregistry/sentinel:dev"
-                                label="Custom Sentinel Docker Image (Dev Only)"
-                                helper="Override the default Sentinel Docker image for testing. Leave empty to use the default." />
-                        </div>
-                    @endif
-                    @if ($server->isSentinelEnabled())
-                        <div class="flex flex-wrap gap-2 sm:flex-nowrap items-end">
-                            <x-forms.input canGate="update" :canResource="$server" type="password" id="sentinelToken"
-                                label="Sentinel token" required helper="Token for Sentinel." />
-                            <x-forms.button canGate="update" :canResource="$server"
-                                wire:click="regenerateSentinelToken">Regenerate</x-forms.button>
-                        </div>
-
-                        <x-forms.input canGate="update" :canResource="$server" id="sentinelCustomUrl" required
-                            label="Coolify URL"
-                            helper="URL to your Coolify instance. If it is empty that means you do not have a FQDN set for your Coolify instance." />
-
-                        <div class="flex flex-col gap-2">
-                            <div class="flex flex-wrap gap-2 sm:flex-nowrap">
-                                <x-forms.input canGate="update" :canResource="$server" type="number" min="1"
-                                    id="sentinelMetricsRefreshRateSeconds" label="Metrics rate (seconds)" required
-                                    helper="Interval used for gathering metrics. Lower values result in more disk space usage." />
-                                <x-forms.input canGate="update" :canResource="$server" type="number" min="1"
-                                    id="sentinelMetricsHistoryDays"
-                                    label="Metrics history (days)" required
-                                    helper="Number of days to retain metrics data for." />
-                                <x-forms.input canGate="update" :canResource="$server" type="number" min="10"
-                                    id="sentinelPushIntervalSeconds" label="Push interval (seconds)" required
-                                    helper="Interval at which metrics data is sent to the collector." />
-                            </div>
-                        </div>
-                    @endif
-                </div>
-            </form>
+            @endif
         </div>
-    </div>
+        @if ($isSentinelEnabled && !$server->isSentinelLive())
+            <x-callout type="warning" title="Out of Sync" class="mt-2">
+                Sentinel is not in sync with your server. Click "Sync" to re-sync.
+            </x-callout>
+        @endif
+        <div class="flex flex-col gap-2 pt-2">
+            @if ($isSentinelEnabled && isDev())
+                <div class="w-full sm:w-96">
+                    <x-forms.checkbox canGate="update" :canResource="$server" id="isSentinelDebugEnabled"
+                        label="Enable Sentinel (with debug)" instantSave />
+                </div>
+            @endif
+            @if (isDev() && $server->isSentinelEnabled())
+                <div class="pt-4" x-data="{
+                    customImage: localStorage.getItem('sentinel_custom_docker_image_{{ $server->uuid }}') || '',
+                    saveCustomImage() {
+                        localStorage.setItem('sentinel_custom_docker_image_{{ $server->uuid }}', this.customImage);
+                        $wire.set('sentinelCustomDockerImage', this.customImage);
+                    }
+                }" x-init="$wire.set('sentinelCustomDockerImage', customImage)">
+                    <x-forms.input canGate="update" :canResource="$server" x-model="customImage"
+                        @input.debounce.500ms="saveCustomImage()"
+                        placeholder="e.g., sentinel:latest or myregistry/sentinel:dev"
+                        label="Custom Sentinel Docker Image (Dev Only)"
+                        helper="Override the default Sentinel Docker image for testing. Leave empty to use the default." />
+                </div>
+            @endif
+            @if ($server->isSentinelEnabled())
+                <div class="flex flex-wrap gap-2 sm:flex-nowrap items-end">
+                    <x-forms.input canGate="update" :canResource="$server" id="sentinelCustomUrl" required
+                        label="Coolify URL"
+                        helper="URL to your Coolify instance. If it is empty that means you do not have a FQDN set for your Coolify instance." />
+                    <x-forms.input canGate="update" :canResource="$server" type="password" id="sentinelToken"
+                        label="Sentinel token" required helper="Token for Sentinel." />
+                    <x-forms.button canGate="update" :canResource="$server"
+                        wire:click="regenerateSentinelToken">Regenerate</x-forms.button>
+                </div>
+
+                <div class="flex flex-col gap-2">
+                    <div class="flex flex-wrap gap-2 sm:flex-nowrap">
+                        <x-forms.input canGate="update" :canResource="$server" type="number" min="1"
+                            id="sentinelMetricsRefreshRateSeconds" label="Metrics rate (seconds)" required
+                            helper="Interval used for gathering metrics. Lower values result in more disk space usage." />
+                        <x-forms.input canGate="update" :canResource="$server" type="number" min="1"
+                            id="sentinelMetricsHistoryDays"
+                            label="Metrics history (days)" required
+                            helper="Number of days to retain metrics data for." />
+                        <x-forms.input canGate="update" :canResource="$server" type="number" min="10"
+                            id="sentinelPushIntervalSeconds" label="Push interval (seconds)" required
+                            helper="Interval at which metrics data is sent to the collector." />
+                    </div>
+                </div>
+            @endif
+        </div>
+    </form>
 </div>
diff --git a/resources/views/livewire/server/sentinel/logs.blade.php b/resources/views/livewire/server/sentinel/logs.blade.php
new file mode 100644
index 000000000..f92f0ab42
--- /dev/null
+++ b/resources/views/livewire/server/sentinel/logs.blade.php
@@ -0,0 +1,13 @@
+<div>
+    <x-slot:title>
+        Sentinel Logs | Coolify
+    </x-slot>
+    <livewire:server.navbar :server="$server" />
+    <div class="flex flex-col h-full gap-8 sm:flex-row">
+        <x-server.sidebar-sentinel :server="$server" :parameters="$parameters" />
+        <div class="w-full">
+            <h2 class="pb-4">Logs</h2>
+            <livewire:project.shared.get-logs :server="$server" container="coolify-sentinel" displayName="Sentinel" :collapsible="false" />
+        </div>
+    </div>
+</div>
diff --git a/resources/views/livewire/server/sentinel/show.blade.php b/resources/views/livewire/server/sentinel/show.blade.php
new file mode 100644
index 000000000..d859a5e14
--- /dev/null
+++ b/resources/views/livewire/server/sentinel/show.blade.php
@@ -0,0 +1,16 @@
+<div>
+    <x-slot:title>
+        Sentinel Configuration | Coolify
+    </x-slot>
+    <livewire:server.navbar :server="$server" />
+    @if ($server->isFunctional())
+        <div class="flex flex-col h-full gap-8 sm:flex-row">
+            <x-server.sidebar-sentinel :server="$server" :parameters="$parameters" />
+            <div class="w-full">
+                <livewire:server.sentinel :server="$server" />
+            </div>
+        </div>
+    @else
+        <div>Server is not validated. Validate first.</div>
+    @endif
+</div>
diff --git a/resources/views/livewire/source/github/change.blade.php b/resources/views/livewire/source/github/change.blade.php
index d52e35646..dc9560a1f 100644
--- a/resources/views/livewire/source/github/change.blade.php
+++ b/resources/views/livewire/source/github/change.blade.php
@@ -351,9 +351,8 @@ class="px-2 py-1 text-xs font-bold uppercase tracking-wide bg-neutral-100 dark:b
                 function createGithubApp(webhook_endpoint, use_custom_webhook_endpoint, custom_webhook_endpoint, preview_deployment_permissions, administration) {
                     const {
                         organization,
-                        html_url,
-                        uuid
-                    } = @js($github_app->only(['organization', 'html_url', 'uuid']));
+                        html_url
+                    } = @js($github_app->only(['organization', 'html_url']));
                     const selectedEndpoint = webhook_endpoint ? webhook_endpoint.trim() : '';
                     const customEndpoint = custom_webhook_endpoint ? custom_webhook_endpoint.trim() : '';
                     if (use_custom_webhook_endpoint && !customEndpoint) {
@@ -401,7 +400,7 @@ function createGithubApp(webhook_endpoint, use_custom_webhook_endpoint, custom_w
                         callback_urls: [`${baseUrl}/login/github/app`],
                         public: false,
                         request_oauth_on_install: false,
-                        setup_url: `${webhookBaseUrl}/source/github/install?source=${uuid}`,
+                        setup_url: `${webhookBaseUrl}/source/github/install`,
                         setup_on_update: true,
                         default_permissions,
                         default_events
diff --git a/routes/web.php b/routes/web.php
index 19fb3b0db..f77277699 100644
--- a/routes/web.php
+++ b/routes/web.php
@@ -7,6 +7,7 @@
 use App\Livewire\Boarding\Index as BoardingIndex;
 use App\Livewire\Dashboard;
 use App\Livewire\Destination\Index as DestinationIndex;
+use App\Livewire\Destination\Resources as DestinationResources;
 use App\Livewire\Destination\Show as DestinationShow;
 use App\Livewire\ForcePasswordReset;
 use App\Livewire\Notifications\Discord as NotificationDiscord;
@@ -57,7 +58,8 @@
 use App\Livewire\Server\Resources as ResourcesShow;
 use App\Livewire\Server\Security\Patches;
 use App\Livewire\Server\Security\TerminalAccess;
-use App\Livewire\Server\Sentinel as ServerSentinel;
+use App\Livewire\Server\Sentinel\Logs as SentinelLogs;
+use App\Livewire\Server\Sentinel\Show as SentinelShow;
 use App\Livewire\Server\Show as ServerShow;
 use App\Livewire\Server\Swarm as ServerSwarm;
 use App\Livewire\Settings\Advanced as SettingsAdvanced;
@@ -281,7 +283,8 @@
         Route::get('/', ServerShow::class)->name('server.show');
         Route::get('/advanced', ServerAdvanced::class)->name('server.advanced');
         Route::get('/swarm', ServerSwarm::class)->name('server.swarm');
-        Route::get('/sentinel', ServerSentinel::class)->name('server.sentinel');
+        Route::get('/sentinel', SentinelShow::class)->name('server.sentinel');
+        Route::get('/sentinel/logs', SentinelLogs::class)->name('server.sentinel.logs');
         Route::get('/private-key', PrivateKeyShow::class)->name('server.private-key');
         Route::get('/cloud-provider-token', CloudProviderTokenShow::class)->name('server.cloud-provider-token');
         Route::get('/ca-certificate', CaCertificateShow::class)->name('server.ca-certificate');
@@ -289,7 +292,7 @@
         Route::get('/cloudflare-tunnel', CloudflareTunnel::class)->name('server.cloudflare-tunnel');
         Route::get('/destinations', ServerDestinations::class)->name('server.destinations');
         Route::get('/log-drains', LogDrains::class)->name('server.log-drains');
-        Route::get('/metrics', ServerCharts::class)->name('server.charts');
+        Route::get('/metrics', ServerCharts::class)->name('server.metrics');
         Route::get('/danger', DeleteServer::class)->name('server.delete');
         Route::get('/proxy', ProxyShow::class)->name('server.proxy');
         Route::get('/proxy/dynamic', ProxyDynamicConfigurations::class)->name('server.proxy.dynamic-confs');
@@ -302,6 +305,7 @@
     });
     Route::get('/destinations', DestinationIndex::class)->name('destination.index');
     Route::get('/destination/{destination_uuid}', DestinationShow::class)->name('destination.show');
+    Route::get('/destination/{destination_uuid}/resources', DestinationResources::class)->name('destination.resources');
 
     // Route::get('/security', fn () => view('security.index'))->name('security.index');
     Route::get('/security/private-key', SecurityPrivateKeyIndex::class)->name('security.private-key.index');
diff --git a/scripts/install.sh b/scripts/install.sh
index 15f172f6d..430dd9d83 100755
--- a/scripts/install.sh
+++ b/scripts/install.sh
@@ -781,10 +781,12 @@ curl -fsSL -L $CDN/.env.production -o /data/coolify/source/.env.production &
 PID3=$!
 curl -fsSL -L $CDN/upgrade.sh -o /data/coolify/source/upgrade.sh &
 PID4=$!
+curl -fsSL -L $CDN/upgrade-postgres.sh -o /data/coolify/source/upgrade-postgres.sh &
+PID5=$!
 
 # Wait for all downloads to complete and check for errors
 DOWNLOAD_FAILED=false
-for PID in $PID1 $PID2 $PID3 $PID4; do
+for PID in $PID1 $PID2 $PID3 $PID4 $PID5; do
     if ! wait $PID; then
         DOWNLOAD_FAILED=true
     fi
@@ -795,6 +797,7 @@ if [ "$DOWNLOAD_FAILED" = true ]; then
     exit 1
 fi
 
+chmod +x /data/coolify/source/upgrade.sh /data/coolify/source/upgrade-postgres.sh
 log "All configuration files downloaded successfully"
 echo "     Done."
 
diff --git a/scripts/upgrade-postgres.sh b/scripts/upgrade-postgres.sh
new file mode 100755
index 000000000..09065875e
--- /dev/null
+++ b/scripts/upgrade-postgres.sh
@@ -0,0 +1,405 @@
+#!/bin/bash
+## Explicit Coolify internal PostgreSQL major-version migrator.
+## This script is intentionally not run by upgrade.sh automatically.
+
+set -Eeuo pipefail
+
+SOURCE_DIR="/data/coolify/source"
+ENV_FILE="${SOURCE_DIR}/.env"
+BACKUP_DIR="/data/coolify/backups/internal-postgres"
+OVERRIDE_FILE="${SOURCE_DIR}/docker-compose.postgres-upgrade.yml"
+ROLLBACK_FILE="${SOURCE_DIR}/postgres-upgrade-rollback.env"
+DATE=$(date +%Y-%m-%d-%H-%M-%S)
+LOGFILE="${SOURCE_DIR}/postgres-upgrade-${DATE}.log"
+COMMAND="${1:-upgrade}"
+TARGET_MAJOR="${1:-18}"
+
+if [ "$COMMAND" = "rollback" ]; then
+    TARGET_MAJOR=""
+else
+    COMMAND="upgrade"
+fi
+
+TARGET_IMAGE="${COOLIFY_POSTGRES_TARGET_IMAGE:-postgres:${TARGET_MAJOR}-alpine}"
+TARGET_VOLUME="${COOLIFY_POSTGRES_TARGET_VOLUME:-coolify-db-pg${TARGET_MAJOR}}"
+TEMP_CONTAINER="coolify-db-pg${TARGET_MAJOR:-rollback}-restore-${DATE}"
+DUMP_FILE="${BACKUP_DIR}/postgres-upgrade-${DATE}.sql.gz"
+
+log() {
+    echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1" | tee -a "$LOGFILE"
+}
+
+fail() {
+    log "ERROR: $1"
+    exit 1
+}
+
+usage() {
+    cat <<EOF
+Usage:
+  $0 <target-major>
+  $0 rollback
+
+Examples:
+  $0 18
+  $0 rollback
+
+Environment overrides:
+  COOLIFY_POSTGRES_TARGET_IMAGE=postgres:18-alpine
+  COOLIFY_POSTGRES_TARGET_VOLUME=coolify-db-pg18
+EOF
+}
+
+cleanup() {
+    docker rm -f "$TEMP_CONTAINER" >/dev/null 2>&1 || true
+}
+trap cleanup EXIT
+
+get_env_var() {
+    local key="$1"
+    local fallback="${2:-}"
+    local value
+
+    value=$(grep -E "^${key}=" "$ENV_FILE" 2>/dev/null | tail -n 1 | cut -d '=' -f 2- || true)
+    value="${value%\"}"
+    value="${value#\"}"
+    value="${value%\'}"
+    value="${value#\'}"
+
+    if [ -z "$value" ]; then
+        printf '%s' "$fallback"
+    else
+        printf '%s' "$value"
+    fi
+}
+
+wait_for_postgres() {
+    local container="$1"
+    local user="$2"
+    local database="$3"
+    local attempts=60
+
+    for _ in $(seq 1 "$attempts"); do
+        if docker exec "$container" pg_isready -U "$user" -d "$database" >/dev/null 2>&1; then
+            return 0
+        fi
+        sleep 2
+    done
+
+    return 1
+}
+
+compose_files() {
+    printf -- '-f %s/docker-compose.yml -f %s/docker-compose.prod.yml ' "$SOURCE_DIR" "$SOURCE_DIR"
+
+    if [ -f "${SOURCE_DIR}/docker-compose.custom.yml" ]; then
+        printf -- '-f %s/docker-compose.custom.yml ' "$SOURCE_DIR"
+    fi
+
+    if [ -f "$OVERRIDE_FILE" ]; then
+        printf -- '-f %s ' "$OVERRIDE_FILE"
+    fi
+}
+
+validate_target_major() {
+    case "$TARGET_MAJOR" in
+        ''|*[!0-9]*)
+            usage
+            fail "Target major version must be numeric. Example: $0 18"
+            ;;
+    esac
+
+    if [ "$TARGET_MAJOR" -lt 10 ]; then
+        fail "Target major version must be 10 or higher."
+    fi
+}
+
+mount_path_for_major() {
+    local major="$1"
+
+    if [ "$major" -ge 18 ]; then
+        printf '%s' '/var/lib/postgresql'
+    else
+        printf '%s' '/var/lib/postgresql/data'
+    fi
+}
+
+current_postgres_mount_name() {
+    docker inspect coolify-db --format '{{range .Mounts}}{{if or (eq .Destination "/var/lib/postgresql/data") (eq .Destination "/var/lib/postgresql")}}{{.Name}}{{end}}{{end}}' 2>/dev/null
+}
+
+current_postgres_mount_path() {
+    docker inspect coolify-db --format '{{range .Mounts}}{{if or (eq .Destination "/var/lib/postgresql/data") (eq .Destination "/var/lib/postgresql")}}{{.Destination}}{{end}}{{end}}' 2>/dev/null
+}
+
+current_postgres_image() {
+    docker inspect coolify-db --format '{{.Config.Image}}' 2>/dev/null
+}
+
+current_coolify_image_tag() {
+    local image
+    local image_without_digest
+    local last_segment
+
+    image=$(docker inspect coolify --format '{{.Config.Image}}' 2>/dev/null || true)
+    image_without_digest="${image%@*}"
+    last_segment="${image_without_digest##*/}"
+
+    if [[ "$last_segment" == *:* ]]; then
+        printf '%s' "${last_segment##*:}"
+    fi
+}
+
+write_override_file() {
+    local image="$1"
+    local volume="$2"
+    local mount_path="$3"
+
+    cat > "$OVERRIDE_FILE" <<YAML
+services:
+  postgres:
+    image: "${image}"
+    volumes:
+      - coolify-db:${mount_path}
+volumes:
+  coolify-db:
+    name: "${volume}"
+    external: true
+YAML
+}
+
+write_rollback_file() {
+    local previous_image="$1"
+    local previous_volume="$2"
+    local previous_mount_path="$3"
+    local previous_override_present="$4"
+    local upgraded_image="$5"
+    local upgraded_volume="$6"
+
+    cat > "$ROLLBACK_FILE" <<EOF
+PREVIOUS_IMAGE='${previous_image}'
+PREVIOUS_VOLUME='${previous_volume}'
+PREVIOUS_MOUNT_PATH='${previous_mount_path}'
+PREVIOUS_OVERRIDE_PRESENT='${previous_override_present}'
+UPGRADED_IMAGE='${upgraded_image}'
+UPGRADED_VOLUME='${upgraded_volume}'
+CREATED_AT='${DATE}'
+EOF
+    chmod 600 "$ROLLBACK_FILE"
+}
+
+start_stack() {
+    local coolify_image_tag="${1:-${LATEST_IMAGE:-latest}}"
+    local files
+    files=$(compose_files)
+
+    # shellcheck disable=SC2086
+    LATEST_IMAGE="$coolify_image_tag" docker compose --env-file "$ENV_FILE" $files up -d --remove-orphans --wait --wait-timeout 120
+}
+
+print_rollback_instructions() {
+    cat <<EOF | tee -a "$LOGFILE"
+
+Rollback command if the upgraded database does not work:
+  ${SOURCE_DIR}/upgrade-postgres.sh rollback
+
+Rollback metadata was saved to:
+  ${ROLLBACK_FILE}
+
+The previous active Docker volume was '${PREVIOUS_VOLUME}'.
+The new Docker volume is '${TARGET_VOLUME}'.
+The dump file is '${DUMP_FILE}'.
+EOF
+}
+
+validate_common_requirements() {
+    mkdir -p "$BACKUP_DIR"
+    touch "$LOGFILE"
+    chmod 700 "$BACKUP_DIR"
+
+    [ -f "$ENV_FILE" ] || fail "Missing ${ENV_FILE}. Run this on a self-hosted Coolify server."
+    command -v docker >/dev/null 2>&1 || fail "Docker is required."
+    docker info >/dev/null 2>&1 || fail "Docker daemon is not reachable."
+}
+
+rollback_postgres() {
+    validate_common_requirements
+
+    [ -f "$ROLLBACK_FILE" ] || fail "Missing rollback metadata file: ${ROLLBACK_FILE}"
+
+    # shellcheck disable=SC1090
+    . "$ROLLBACK_FILE"
+
+    [ -n "${PREVIOUS_IMAGE:-}" ] || fail "Rollback metadata is missing PREVIOUS_IMAGE."
+    [ -n "${PREVIOUS_VOLUME:-}" ] || fail "Rollback metadata is missing PREVIOUS_VOLUME."
+    [ -n "${PREVIOUS_MOUNT_PATH:-}" ] || fail "Rollback metadata is missing PREVIOUS_MOUNT_PATH."
+    [ -n "${PREVIOUS_OVERRIDE_PRESENT:-}" ] || fail "Rollback metadata is missing PREVIOUS_OVERRIDE_PRESENT."
+
+    CURRENT_COOLIFY_IMAGE_TAG=$(current_coolify_image_tag)
+
+    log "Rolling back Coolify internal PostgreSQL."
+    log "Previous image: ${PREVIOUS_IMAGE}"
+    log "Previous volume: ${PREVIOUS_VOLUME}"
+    log "Previous mount path: ${PREVIOUS_MOUNT_PATH}"
+    log "Current Coolify image tag: ${CURRENT_COOLIFY_IMAGE_TAG:-latest}"
+
+    docker volume inspect "$PREVIOUS_VOLUME" >/dev/null 2>&1 || fail "Previous volume '${PREVIOUS_VOLUME}' does not exist."
+
+    log "Stopping Coolify application container before rollback."
+    docker stop coolify >>"$LOGFILE" 2>&1 || true
+
+    log "Removing current coolify-db container. Current upgraded volume is kept untouched."
+    docker rm -f coolify-db >>"$LOGFILE" 2>&1 || true
+
+    if [ "$PREVIOUS_OVERRIDE_PRESENT" = "true" ]; then
+        log "Restoring previous PostgreSQL compose override."
+        write_override_file "$PREVIOUS_IMAGE" "$PREVIOUS_VOLUME" "$PREVIOUS_MOUNT_PATH"
+    else
+        log "Removing PostgreSQL compose override to restore base compose configuration."
+        rm -f "$OVERRIDE_FILE"
+    fi
+
+    log "Starting Coolify stack with rollback database volume."
+    start_stack "$CURRENT_COOLIFY_IMAGE_TAG" >>"$LOGFILE" 2>&1 || fail "Could not start Coolify stack after rollback. See ${LOGFILE}."
+
+    log "Rollback completed successfully."
+    cat <<EOF | tee -a "$LOGFILE"
+
+Rollback completed.
+Current active PostgreSQL volume should be '${PREVIOUS_VOLUME}'.
+The upgraded volume '${UPGRADED_VOLUME:-unknown}' was left untouched for inspection or manual cleanup.
+EOF
+}
+
+upgrade_postgres() {
+    validate_target_major
+    TARGET_MOUNT_PATH=$(mount_path_for_major "$TARGET_MAJOR")
+    validate_common_requirements
+
+    log "Starting Coolify internal PostgreSQL major upgrade."
+    log "Target major: ${TARGET_MAJOR}"
+    log "Target image: ${TARGET_IMAGE}"
+    log "Target volume: ${TARGET_VOLUME}"
+    log "Target mount path: ${TARGET_MOUNT_PATH}"
+
+    DB_USERNAME=$(get_env_var DB_USERNAME coolify)
+    DB_DATABASE=$(get_env_var DB_DATABASE coolify)
+
+    if ! docker ps -a --format '{{.Names}}' | grep -qx 'coolify-db'; then
+        fail "Container 'coolify-db' was not found. Start Coolify before running this script."
+    fi
+
+    if ! docker ps --format '{{.Names}}' | grep -qx 'coolify-db'; then
+        log "Starting existing coolify-db container for version detection and dump."
+        docker start coolify-db >>"$LOGFILE" 2>&1 || fail "Could not start coolify-db."
+    fi
+
+    wait_for_postgres coolify-db "$DB_USERNAME" "$DB_DATABASE" || fail "Existing coolify-db is not ready."
+
+    SERVER_VERSION_NUM=$(docker exec coolify-db psql -U "$DB_USERNAME" -d "$DB_DATABASE" -Atc 'SHOW server_version_num;' | tr -d '[:space:]')
+    CURRENT_MAJOR=$((SERVER_VERSION_NUM / 10000))
+    PREVIOUS_VOLUME=$(current_postgres_mount_name)
+    PREVIOUS_MOUNT_PATH=$(current_postgres_mount_path)
+    PREVIOUS_IMAGE=$(current_postgres_image)
+    CURRENT_COOLIFY_IMAGE_TAG=$(current_coolify_image_tag)
+
+    [ -n "$PREVIOUS_VOLUME" ] || fail "Could not detect current PostgreSQL Docker volume."
+    [ -n "$PREVIOUS_MOUNT_PATH" ] || fail "Could not detect current PostgreSQL mount path."
+    [ -n "$PREVIOUS_IMAGE" ] || fail "Could not detect current PostgreSQL image."
+
+    if [ -f "$OVERRIDE_FILE" ]; then
+        PREVIOUS_OVERRIDE_PRESENT=true
+    else
+        PREVIOUS_OVERRIDE_PRESENT=false
+    fi
+
+    log "Current PostgreSQL major: ${CURRENT_MAJOR}"
+    log "Current active volume: ${PREVIOUS_VOLUME}"
+    log "Current image: ${PREVIOUS_IMAGE}"
+    log "Current mount path: ${PREVIOUS_MOUNT_PATH}"
+    log "Current Coolify image tag: ${CURRENT_COOLIFY_IMAGE_TAG:-latest}"
+
+    if [ "$CURRENT_MAJOR" -eq "$TARGET_MAJOR" ]; then
+        log "PostgreSQL is already on major ${TARGET_MAJOR}. Nothing to do."
+        exit 0
+    fi
+
+    if [ "$CURRENT_MAJOR" -gt "$TARGET_MAJOR" ]; then
+        fail "Downgrade from ${CURRENT_MAJOR} to ${TARGET_MAJOR} is not supported. Use '$0 rollback' to restore the previous upgrade state."
+    fi
+
+    if docker volume inspect "$TARGET_VOLUME" >/dev/null 2>&1; then
+        fail "Target volume '${TARGET_VOLUME}' already exists. Set COOLIFY_POSTGRES_TARGET_VOLUME to a new name or remove the old failed target volume."
+    fi
+
+    log "Stopping Coolify application container to prevent writes during dump."
+    docker stop coolify >>"$LOGFILE" 2>&1 || true
+
+    log "Creating compressed dump at ${DUMP_FILE}."
+    docker exec coolify-db pg_dumpall -U "$DB_USERNAME" | gzip -c > "$DUMP_FILE"
+    chmod 600 "$DUMP_FILE"
+
+    if [ ! -s "$DUMP_FILE" ]; then
+        fail "Dump file is empty. Aborting."
+    fi
+
+    log "Creating target Docker volume '${TARGET_VOLUME}'."
+    docker volume create "$TARGET_VOLUME" >>"$LOGFILE" 2>&1
+
+    log "Pulling ${TARGET_IMAGE}."
+    docker pull "$TARGET_IMAGE" >>"$LOGFILE" 2>&1
+
+    log "Starting temporary PostgreSQL ${TARGET_MAJOR} container."
+    docker run -d \
+        --name "$TEMP_CONTAINER" \
+        --network coolify \
+        -e POSTGRES_HOST_AUTH_METHOD=trust \
+        -v "${TARGET_VOLUME}:${TARGET_MOUNT_PATH}" \
+        "$TARGET_IMAGE" >>"$LOGFILE" 2>&1
+
+    wait_for_postgres "$TEMP_CONTAINER" postgres postgres || fail "Temporary PostgreSQL ${TARGET_MAJOR} container did not become ready."
+
+    log "Restoring dump into target volume."
+    gunzip -c "$DUMP_FILE" | docker exec -i "$TEMP_CONTAINER" psql -U postgres -d postgres >>"$LOGFILE" 2>&1
+
+    log "Smoke-checking restored Coolify database."
+    docker exec "$TEMP_CONTAINER" psql -U "$DB_USERNAME" -d "$DB_DATABASE" -Atc 'SELECT 1;' | grep -qx '1' || fail "Restored database smoke check failed."
+
+    log "Saving rollback metadata to ${ROLLBACK_FILE}."
+    write_rollback_file "$PREVIOUS_IMAGE" "$PREVIOUS_VOLUME" "$PREVIOUS_MOUNT_PATH" "$PREVIOUS_OVERRIDE_PRESENT" "$TARGET_IMAGE" "$TARGET_VOLUME"
+
+    log "Writing Docker Compose override to ${OVERRIDE_FILE}."
+    write_override_file "$TARGET_IMAGE" "$TARGET_VOLUME" "$TARGET_MOUNT_PATH"
+
+    log "Stopping temporary restore container."
+    docker rm -f "$TEMP_CONTAINER" >>"$LOGFILE" 2>&1 || true
+
+    log "Stopping old coolify-db container. Previous volume '${PREVIOUS_VOLUME}' will be kept for rollback."
+    docker rm -f coolify-db >>"$LOGFILE" 2>&1 || true
+
+    log "Starting Coolify stack with PostgreSQL ${TARGET_MAJOR}."
+    start_stack "$CURRENT_COOLIFY_IMAGE_TAG" >>"$LOGFILE" 2>&1 || fail "Could not start Coolify stack with upgraded PostgreSQL. See ${LOGFILE}."
+
+    log "Coolify internal PostgreSQL upgrade completed successfully."
+    print_rollback_instructions
+}
+
+if [ "${COOLIFY_POSTGRES_UPGRADE_SOURCE_ONLY:-false}" = "true" ] && [ "${BASH_SOURCE[0]}" != "$0" ]; then
+    return 0
+fi
+
+case "$COMMAND" in
+    rollback)
+        rollback_postgres
+        ;;
+    upgrade)
+        upgrade_postgres
+        ;;
+    -h|--help|help)
+        usage
+        ;;
+    *)
+        usage
+        fail "Unknown command: ${COMMAND}"
+        ;;
+esac
diff --git a/scripts/upgrade.sh b/scripts/upgrade.sh
index f32db9b8d..fb27694b0 100644
--- a/scripts/upgrade.sh
+++ b/scripts/upgrade.sh
@@ -56,6 +56,9 @@ log "Downloading docker-compose.prod.yml from ${CDN}/docker-compose.prod.yml"
 curl -fsSL -L $CDN/docker-compose.prod.yml -o /data/coolify/source/docker-compose.prod.yml
 log "Downloading .env.production from ${CDN}/.env.production"
 curl -fsSL -L $CDN/.env.production -o /data/coolify/source/.env.production
+log "Downloading upgrade-postgres.sh from ${CDN}/upgrade-postgres.sh"
+curl -fsSL -L $CDN/upgrade-postgres.sh -o /data/coolify/source/upgrade-postgres.sh
+chmod +x /data/coolify/source/upgrade-postgres.sh
 log "Configuration files downloaded successfully"
 echo "     Done."
 
@@ -69,6 +72,12 @@ if [ -f /data/coolify/source/docker-compose.custom.yml ]; then
     log "Including custom docker-compose.yml in image extraction"
 fi
 
+# Check if PostgreSQL upgrade override exists
+if [ -f /data/coolify/source/docker-compose.postgres-upgrade.yml ]; then
+    COMPOSE_FILES="$COMPOSE_FILES -f /data/coolify/source/docker-compose.postgres-upgrade.yml"
+    log "Including PostgreSQL upgrade compose override in image extraction"
+fi
+
 # Get all unique images from docker compose config
 # LATEST_IMAGE env var is needed for image substitution in compose files
 IMAGES=$(LATEST_IMAGE=${LATEST_IMAGE} docker compose --env-file "$ENV_FILE" $COMPOSE_FILES config --images 2>/dev/null | sort -u)
@@ -245,15 +254,18 @@ nohup bash -c "
     echo '============================================================' >>\"\$LOGFILE\"
     write_status '5' 'Starting new containers'
 
+    COMPOSE_FILES='-f /data/coolify/source/docker-compose.yml -f /data/coolify/source/docker-compose.prod.yml'
     if [ -f /data/coolify/source/docker-compose.custom.yml ]; then
         log 'Using custom docker-compose.yml'
-        log 'Running docker compose up with custom configuration...'
-        docker run -v /data/coolify/source:/data/coolify/source -v /var/run/docker.sock:/var/run/docker.sock \${DOCKER_CONFIG_MOUNT} --rm \${REGISTRY_URL:-ghcr.io}/coollabsio/coolify-helper:\${LATEST_HELPER_VERSION} bash -c \"LATEST_IMAGE=\${LATEST_IMAGE} docker compose --env-file /data/coolify/source/.env -f /data/coolify/source/docker-compose.yml -f /data/coolify/source/docker-compose.prod.yml -f /data/coolify/source/docker-compose.custom.yml up -d --remove-orphans --wait --wait-timeout 60\" >>\"\$LOGFILE\" 2>&1
-    else
-        log 'Using standard docker-compose configuration'
-        log 'Running docker compose up...'
-        docker run -v /data/coolify/source:/data/coolify/source -v /var/run/docker.sock:/var/run/docker.sock \${DOCKER_CONFIG_MOUNT} --rm \${REGISTRY_URL:-ghcr.io}/coollabsio/coolify-helper:\${LATEST_HELPER_VERSION} bash -c \"LATEST_IMAGE=\${LATEST_IMAGE} docker compose --env-file /data/coolify/source/.env -f /data/coolify/source/docker-compose.yml -f /data/coolify/source/docker-compose.prod.yml up -d --remove-orphans --wait --wait-timeout 60\" >>\"\$LOGFILE\" 2>&1
+        COMPOSE_FILES=\"\$COMPOSE_FILES -f /data/coolify/source/docker-compose.custom.yml\"
     fi
+    if [ -f /data/coolify/source/docker-compose.postgres-upgrade.yml ]; then
+        log 'Using PostgreSQL upgrade compose override'
+        COMPOSE_FILES=\"\$COMPOSE_FILES -f /data/coolify/source/docker-compose.postgres-upgrade.yml\"
+    fi
+
+    log 'Running docker compose up...'
+    docker run -v /data/coolify/source:/data/coolify/source -v /var/run/docker.sock:/var/run/docker.sock \${DOCKER_CONFIG_MOUNT} --rm \${REGISTRY_URL:-ghcr.io}/coollabsio/coolify-helper:\${LATEST_HELPER_VERSION} bash -c \"LATEST_IMAGE=\${LATEST_IMAGE} docker compose --env-file /data/coolify/source/.env \${COMPOSE_FILES} up -d --remove-orphans --wait --wait-timeout 60\" >>\"\$LOGFILE\" 2>&1
     log 'Docker compose up completed'
 
     # Final log entry
diff --git a/templates/compose/owncloud.yaml b/templates/compose/owncloud.yaml
index 689a03504..c341a5390 100644
--- a/templates/compose/owncloud.yaml
+++ b/templates/compose/owncloud.yaml
@@ -15,8 +15,8 @@ services:
         condition: service_healthy
     environment:
       - SERVICE_URL_OWNCLOUD_8080
-      - OWNCLOUD_DOMAIN=${SERVICE_URL_OWNCLOUD}
-      - OWNCLOUD_TRUSTED_DOMAINS=${SERVICE_URL_OWNCLOUD}
+      - OWNCLOUD_DOMAIN=${SERVICE_FQDN_OWNCLOUD}
+      - OWNCLOUD_TRUSTED_DOMAINS=${SERVICE_FQDN_OWNCLOUD}
       - OWNCLOUD_DB_TYPE=mysql
       - OWNCLOUD_DB_HOST=mariadb
       - OWNCLOUD_DB_NAME=${DB_NAME:-owncloud}
diff --git a/templates/service-templates-latest.json b/templates/service-templates-latest.json
index d1fb5e387..7df83fcc8 100644
--- a/templates/service-templates-latest.json
+++ b/templates/service-templates-latest.json
@@ -1620,7 +1620,7 @@
     "garage": {
         "documentation": "https://garagehq.deuxfleurs.fr/documentation/?utm_source=coolify.io",
         "slogan": "Garage is an S3-compatible distributed object storage service designed for self-hosting.",
-        "compose": "c2VydmljZXM6CiAgZ2FyYWdlOgogICAgaW1hZ2U6ICdkeGZscnMvZ2FyYWdlOnYyLjEuMCcKICAgIGVudmlyb25tZW50OgogICAgICAtIEdBUkFHRV9TM19BUElfVVJMPSRHQVJBR0VfUzNfQVBJX1VSTAogICAgICAtIEdBUkFHRV9XRUJfVVJMPSRHQVJBR0VfV0VCX1VSTAogICAgICAtIEdBUkFHRV9BRE1JTl9VUkw9JEdBUkFHRV9BRE1JTl9VUkwKICAgICAgLSAnR0FSQUdFX1JQQ19TRUNSRVQ9JHtTRVJWSUNFX0hFWF8zMl9SUENTRUNSRVR9JwogICAgICAtIEdBUkFHRV9BRE1JTl9UT0tFTj0kU0VSVklDRV9QQVNTV09SRF9HQVJBR0UKICAgICAgLSBHQVJBR0VfTUVUUklDU19UT0tFTj0kU0VSVklDRV9QQVNTV09SRF9HQVJBR0VNRVRSSUNTCiAgICAgIC0gR0FSQUdFX0FMTE9XX1dPUkxEX1JFQURBQkxFX1NFQ1JFVFM9dHJ1ZQogICAgICAtICdSVVNUX0xPRz0ke1JVU1RfTE9HOi1nYXJhZ2U9aW5mb30nCiAgICB2b2x1bWVzOgogICAgICAtICdnYXJhZ2UtbWV0YTovdmFyL2xpYi9nYXJhZ2UvbWV0YScKICAgICAgLSAnZ2FyYWdlLWRhdGE6L3Zhci9saWIvZ2FyYWdlL2RhdGEnCiAgICAgIC0KICAgICAgICB0eXBlOiBiaW5kCiAgICAgICAgc291cmNlOiAuL2dhcmFnZS50b21sCiAgICAgICAgdGFyZ2V0OiAvZXRjL2dhcmFnZS50b21sCiAgICAgICAgY29udGVudDogIm1ldGFkYXRhX2RpciA9IFwiL3Zhci9saWIvZ2FyYWdlL21ldGFcIlxuZGF0YV9kaXIgPSBcIi92YXIvbGliL2dhcmFnZS9kYXRhXCJcbmRiX2VuZ2luZSA9IFwibG1kYlwiXG5cbnJlcGxpY2F0aW9uX2ZhY3RvciA9IDFcbmNvbnNpc3RlbmN5X21vZGUgPSBcImNvbnNpc3RlbnRcIlxuXG5jb21wcmVzc2lvbl9sZXZlbCA9IDFcbmJsb2NrX3NpemUgPSBcIjFNXCJcblxucnBjX2JpbmRfYWRkciA9IFwiWzo6XTozOTAxXCJcbnJwY19zZWNyZXRfZmlsZSA9IFwiZW52OkdBUkFHRV9SUENfU0VDUkVUXCJcbmJvb3RzdHJhcF9wZWVycyA9IFtdXG5cbltzM19hcGldXG5zM19yZWdpb24gPSBcImdhcmFnZVwiXG5hcGlfYmluZF9hZGRyID0gXCJbOjpdOjM5MDBcIlxucm9vdF9kb21haW4gPSBcIi5zMy5nYXJhZ2UubG9jYWxob3N0XCJcblxuW3MzX3dlYl1cbmJpbmRfYWRkciA9IFwiWzo6XTozOTAyXCJcbnJvb3RfZG9tYWluID0gXCIud2ViLmdhcmFnZS5sb2NhbGhvc3RcIlxuXG5bYWRtaW5dXG5hcGlfYmluZF9hZGRyID0gXCJbOjpdOjM5MDNcIlxuYWRtaW5fdG9rZW5fZmlsZSA9IFwiZW52OkdBUkFHRV9BRE1JTl9UT0tFTlwiXG5tZXRyaWNzX3Rva2VuX2ZpbGUgPSBcImVudjpHQVJBR0VfTUVUUklDU19UT0tFTlwiIgogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIC9nYXJhZ2UKICAgICAgICAtIHN0YXRzCiAgICAgICAgLSAnLWEnCiAgICAgIGludGVydmFsOiAxMHMKICAgICAgdGltZW91dDogNXMKICAgICAgcmV0cmllczogNQo=",
+        "compose": "c2VydmljZXM6CiAgZ2FyYWdlOgogICAgaW1hZ2U6ICdkeGZscnMvZ2FyYWdlOnYyLjEuMCcKICAgIGVudmlyb25tZW50OgogICAgICAtIEdBUkFHRV9TM19BUElfVVJMPSRHQVJBR0VfUzNfQVBJX1VSTAogICAgICAtIEdBUkFHRV9XRUJfVVJMPSRHQVJBR0VfV0VCX1VSTAogICAgICAtIEdBUkFHRV9BRE1JTl9VUkw9JEdBUkFHRV9BRE1JTl9VUkwKICAgICAgLSAnR0FSQUdFX1JQQ19TRUNSRVQ9JHtTRVJWSUNFX0hFWF82NF9SUENTRUNSRVR9JwogICAgICAtIEdBUkFHRV9BRE1JTl9UT0tFTj0kU0VSVklDRV9QQVNTV09SRF9HQVJBR0UKICAgICAgLSBHQVJBR0VfTUVUUklDU19UT0tFTj0kU0VSVklDRV9QQVNTV09SRF9HQVJBR0VNRVRSSUNTCiAgICAgIC0gR0FSQUdFX0FMTE9XX1dPUkxEX1JFQURBQkxFX1NFQ1JFVFM9dHJ1ZQogICAgICAtICdSVVNUX0xPRz0ke1JVU1RfTE9HOi1nYXJhZ2U9aW5mb30nCiAgICB2b2x1bWVzOgogICAgICAtICdnYXJhZ2UtbWV0YTovdmFyL2xpYi9nYXJhZ2UvbWV0YScKICAgICAgLSAnZ2FyYWdlLWRhdGE6L3Zhci9saWIvZ2FyYWdlL2RhdGEnCiAgICAgIC0KICAgICAgICB0eXBlOiBiaW5kCiAgICAgICAgc291cmNlOiAuL2dhcmFnZS50b21sCiAgICAgICAgdGFyZ2V0OiAvZXRjL2dhcmFnZS50b21sCiAgICAgICAgY29udGVudDogIm1ldGFkYXRhX2RpciA9IFwiL3Zhci9saWIvZ2FyYWdlL21ldGFcIlxuZGF0YV9kaXIgPSBcIi92YXIvbGliL2dhcmFnZS9kYXRhXCJcbmRiX2VuZ2luZSA9IFwibG1kYlwiXG5cbnJlcGxpY2F0aW9uX2ZhY3RvciA9IDFcbmNvbnNpc3RlbmN5X21vZGUgPSBcImNvbnNpc3RlbnRcIlxuXG5jb21wcmVzc2lvbl9sZXZlbCA9IDFcbmJsb2NrX3NpemUgPSBcIjFNXCJcblxucnBjX2JpbmRfYWRkciA9IFwiWzo6XTozOTAxXCJcbnJwY19zZWNyZXRfZmlsZSA9IFwiZW52OkdBUkFHRV9SUENfU0VDUkVUXCJcbmJvb3RzdHJhcF9wZWVycyA9IFtdXG5cbltzM19hcGldXG5zM19yZWdpb24gPSBcImdhcmFnZVwiXG5hcGlfYmluZF9hZGRyID0gXCJbOjpdOjM5MDBcIlxucm9vdF9kb21haW4gPSBcIi5zMy5nYXJhZ2UubG9jYWxob3N0XCJcblxuW3MzX3dlYl1cbmJpbmRfYWRkciA9IFwiWzo6XTozOTAyXCJcbnJvb3RfZG9tYWluID0gXCIud2ViLmdhcmFnZS5sb2NhbGhvc3RcIlxuXG5bYWRtaW5dXG5hcGlfYmluZF9hZGRyID0gXCJbOjpdOjM5MDNcIlxuYWRtaW5fdG9rZW5fZmlsZSA9IFwiZW52OkdBUkFHRV9BRE1JTl9UT0tFTlwiXG5tZXRyaWNzX3Rva2VuX2ZpbGUgPSBcImVudjpHQVJBR0VfTUVUUklDU19UT0tFTlwiIgogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIC9nYXJhZ2UKICAgICAgICAtIHN0YXRzCiAgICAgICAgLSAnLWEnCiAgICAgIGludGVydmFsOiAxMHMKICAgICAgdGltZW91dDogNXMKICAgICAgcmV0cmllczogNQo=",
         "tags": [
             "object",
             "storage",
@@ -1666,7 +1666,7 @@
     "gitea-runner": {
         "documentation": "https://github.com/go-gitea/gitea?utm_source=coolify.io",
         "slogan": "Gitea Actions runner for docker",
-        "compose": "c2VydmljZXM6CiAgcnVubmVyOgogICAgaW1hZ2U6ICdkb2NrZXIuaW8vZ2l0ZWEvcnVubmVyOjEuMC42JwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ0dJVEVBX0lOU1RBTkNFX1VSTD0ke0dJVEVBX0lOU1RBTkNFX1VSTH0nCiAgICAgIC0gJ0dJVEVBX1JVTk5FUl9SRUdJU1RSQVRJT05fVE9LRU49JHtHSVRFQV9SVU5ORVJfUkVHSVNUUkFUSU9OX1RPS0VOfScKICAgICAgLSAnR0lURUFfUlVOTkVSX05BTUU9JHtHSVRFQV9SVU5ORVJfTkFNRTotZ2l0ZWEtcnVubmVyfScKICAgICAgLSAnR0lURUFfUlVOTkVSX0xBQkVMUz0ke0dJVEVBX1JVTk5FUl9MQUJFTFM6LXVidW50dS1sYXRlc3Q6ZG9ja2VyOi8vbm9kZToyMn0nCiAgICAgIC0gJ0dJVEVBX1RPS0VOPSR7R0lURUFfVE9LRU59JwogICAgd29ya2luZ19kaXI6IC9kYXRhCiAgICB2b2x1bWVzOgogICAgICAtICdydW5uZXItZGF0YTovZGF0YScKICAgICAgLSAnL3Zhci9ydW4vZG9ja2VyLnNvY2s6L3Zhci9ydW4vZG9ja2VyLnNvY2snCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRC1TSEVMTAogICAgICAgIC0gInBzIGF1eCB8IGdyZXAgJ1tSXXVubmVyJyA+IC9kZXYvbnVsbCB8fCBleGl0IDEiCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMTUK",
+        "compose": "c2VydmljZXM6CiAgcnVubmVyOgogICAgaW1hZ2U6ICdkb2NrZXIuaW8vZ2l0ZWEvcnVubmVyOjEuMC43JwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ0dJVEVBX0lOU1RBTkNFX1VSTD0ke0dJVEVBX0lOU1RBTkNFX1VSTH0nCiAgICAgIC0gJ0dJVEVBX1JVTk5FUl9SRUdJU1RSQVRJT05fVE9LRU49JHtHSVRFQV9SVU5ORVJfUkVHSVNUUkFUSU9OX1RPS0VOfScKICAgICAgLSAnR0lURUFfUlVOTkVSX05BTUU9JHtHSVRFQV9SVU5ORVJfTkFNRTotZ2l0ZWEtcnVubmVyfScKICAgICAgLSAnR0lURUFfUlVOTkVSX0xBQkVMUz0ke0dJVEVBX1JVTk5FUl9MQUJFTFM6LXVidW50dS1sYXRlc3Q6ZG9ja2VyOi8vbm9kZToyMn0nCiAgICAgIC0gJ0dJVEVBX1RPS0VOPSR7R0lURUFfVE9LRU59JwogICAgd29ya2luZ19kaXI6IC9kYXRhCiAgICB2b2x1bWVzOgogICAgICAtICdydW5uZXItZGF0YTovZGF0YScKICAgICAgLSAnL3Zhci9ydW4vZG9ja2VyLnNvY2s6L3Zhci9ydW4vZG9ja2VyLnNvY2snCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRC1TSEVMTAogICAgICAgIC0gInBzIGF1eCB8IGdyZXAgJ1tSXXVubmVyJyA+IC9kZXYvbnVsbCB8fCBleGl0IDEiCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMTUK",
         "tags": [
             "gitea",
             "actions",
@@ -2007,6 +2007,24 @@
         "minversion": "0.0.0",
         "port": "80"
     },
+    "healthchecks": {
+        "documentation": "https://healthchecks.io/docs?utm_source=coolify.io",
+        "slogan": "Healthchecks is a cron job monitoring service. It listens for HTTP requests and email messages from your cron jobs and scheduled tasks.",
+        "compose": "c2VydmljZXM6CiAgaGVhbHRoY2hlY2tzOgogICAgaW1hZ2U6ICdoZWFsdGhjaGVja3MvaGVhbHRoY2hlY2tzOnY0LjInCiAgICBjb250YWluZXJfbmFtZTogaGVhbHRoY2hlY2tzCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX1VSTF9IRUFMVEhDSEVDS1NfODAwMAogICAgICAtIERCPXNxbGl0ZQogICAgICAtIERCX05BTUU9L2RhdGEvaGMuc3FsaXRlCiAgICAgIC0gJ0FMTE9XRURfSE9TVFM9JHtBTExPV0VEX0hPU1RTOi0qfScKICAgICAgLSAnUkVHSVNUUkFUSU9OX09QRU49JHtSRUdJU1RSQVRJT05fT1BFTjotVHJ1ZX0nCiAgICAgIC0gJ0RFQlVHPSR7REVCVUc6LUZhbHNlfScKICAgICAgLSAnU0VDUkVUX0tFWT0ke1NFQ1JFVF9LRVk6PyR7U0VSVklDRV9QQVNTV09SRF82NF9IRUFMVEhDSEVDS1N9fScKICAgICAgLSAnU0lURV9ST09UPSR7U0VSVklDRV9VUkxfSEVBTFRIQ0hFQ0tTfScKICAgICAgLSAnREVGQVVMVF9GUk9NX0VNQUlMPSR7REVGQVVMVF9GUk9NX0VNQUlMOi1maXhtZS1lbWFpbC1hZGRyZXNzLWhlcmV9JwogICAgICAtICdFTUFJTF9IT1NUPSR7RU1BSUxfSE9TVDotbXktc210cC1zZXJ2ZXItaGVyZS5jb219JwogICAgICAtICdFTUFJTF9QT1JUPSR7RU1BSUxfUE9SVDotNDY1fScKICAgICAgLSAnRU1BSUxfSE9TVF9VU0VSPSR7RU1BSUxfSE9TVF9VU0VSOi1teV91c2VybmFtZX0nCiAgICAgIC0gJ0VNQUlMX0hPU1RfUEFTU1dPUkQ9JHtFTUFJTF9IT1NUX1BBU1NXT1JEOi1teXBhc3N3b3JkfScKICAgICAgLSAnRU1BSUxfVVNFX1NTTD0ke0VNQUlMX1VTRV9TU0w6LVRydWV9JwogICAgICAtICdFTUFJTF9VU0VfVExTPSR7RU1BSUxfVVNFX1RMUzotRmFsc2V9JwogICAgdm9sdW1lczoKICAgICAgLSAnaGVhbHRoY2hlY2tzLWRhdGE6L2RhdGEnCg==",
+        "tags": [
+            "monitoring",
+            "status",
+            "performance",
+            "web",
+            "services",
+            "applications",
+            "real-time"
+        ],
+        "category": "monitoring",
+        "logo": "svgs/healthchecks.webp",
+        "minversion": "0.0.0",
+        "port": "80000"
+    },
     "heimdall": {
         "documentation": "https://github.com/linuxserver/Heimdall?utm_source=coolify.io",
         "slogan": "Heimdall is a dashboard for managing and organizing your server applications.",
@@ -3622,7 +3640,7 @@
     "owncloud": {
         "documentation": "https://owncloud.com/docs-guides/?utm_source=coolify.io",
         "slogan": "OwnCloud with Open Web UI integrates file management with a powerful, user-friendly interface.",
-        "compose": "c2VydmljZXM6CiAgb3duY2xvdWQ6CiAgICBpbWFnZTogJ293bmNsb3VkL3NlcnZlcjpsYXRlc3QnCiAgICBkZXBlbmRzX29uOgogICAgICBtYXJpYWRiOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIHJlZGlzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX1VSTF9PV05DTE9VRF84MDgwCiAgICAgIC0gJ09XTkNMT1VEX0RPTUFJTj0ke1NFUlZJQ0VfVVJMX09XTkNMT1VEfScKICAgICAgLSAnT1dOQ0xPVURfVFJVU1RFRF9ET01BSU5TPSR7U0VSVklDRV9VUkxfT1dOQ0xPVUR9JwogICAgICAtIE9XTkNMT1VEX0RCX1RZUEU9bXlzcWwKICAgICAgLSBPV05DTE9VRF9EQl9IT1NUPW1hcmlhZGIKICAgICAgLSAnT1dOQ0xPVURfREJfTkFNRT0ke0RCX05BTUU6LW93bmNsb3VkfScKICAgICAgLSAnT1dOQ0xPVURfREJfVVNFUk5BTUU9JHtTRVJWSUNFX1VTRVJfTUFSSUFEQn0nCiAgICAgIC0gJ09XTkNMT1VEX0RCX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9NQVJJQURCfScKICAgICAgLSAnT1dOQ0xPVURfQURNSU5fVVNFUk5BTUU9JHtTRVJWSUNFX1VTRVJfT1dOQ0xPVUR9JwogICAgICAtICdPV05DTE9VRF9BRE1JTl9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfT1dOQ0xPVUR9JwogICAgICAtICdPV05DTE9VRF9NWVNRTF9VVEY4TUI0PSR7TVlTUUxfVVRGOE1CNDotdHJ1ZX0nCiAgICAgIC0gJ09XTkNMT1VEX1JFRElTX0VOQUJMRUQ9JHtSRURJU19FTkFCTEVEOi10cnVlfScKICAgICAgLSBPV05DTE9VRF9SRURJU19IT1NUPXJlZGlzCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gL3Vzci9iaW4vaGVhbHRoY2hlY2sKICAgICAgaW50ZXJ2YWw6IDMwcwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogNQogICAgdm9sdW1lczoKICAgICAgLSAnb3duY2xvdWQtZGF0YTovbW50L2RhdGEnCiAgbWFyaWFkYjoKICAgIGltYWdlOiAnbWFyaWFkYjpsYXRlc3QnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnTVlTUUxfUk9PVF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfTUFSSUFEQlJPT1R9JwogICAgICAtICdNWVNRTF9VU0VSPSR7U0VSVklDRV9VU0VSX01BUklBREJ9JwogICAgICAtICdNWVNRTF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfTUFSSUFEQn0nCiAgICAgIC0gJ01ZU1FMX0RBVEFCQVNFPSR7REJfTkFNRTotb3duY2xvdWR9JwogICAgICAtIFRaPWF1dG8KICAgIGNvbW1hbmQ6CiAgICAgIC0gJy0tY2hhcmFjdGVyLXNldC1zZXJ2ZXI9dXRmOG1iNCcKICAgICAgLSAnLS1jb2xsYXRpb24tc2VydmVyPXV0ZjhtYjRfYmluJwogICAgICAtICctLW1heC1hbGxvd2VkLXBhY2tldD0xMjhNJwogICAgICAtICctLWlubm9kYi1sb2ctZmlsZS1zaXplPTY0TScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBoZWFsdGhjaGVjay5zaAogICAgICAgIC0gJy0tY29ubmVjdCcKICAgICAgICAtICctLWlubm9kYl9pbml0aWFsaXplZCcKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiAxMAogICAgdm9sdW1lczoKICAgICAgLSAnb3duY2xvdWQtbXlzcWwtZGF0YTovdmFyL2xpYi9teXNxbCcKICByZWRpczoKICAgIGltYWdlOiAncmVkaXM6NicKICAgIGNvbW1hbmQ6CiAgICAgIC0gJy0tZGF0YWJhc2VzJwogICAgICAtICcxJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIHJlZGlzLWNsaQogICAgICAgIC0gcGluZwogICAgICBpbnRlcnZhbDogMTBzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDUK",
+        "compose": "c2VydmljZXM6CiAgb3duY2xvdWQ6CiAgICBpbWFnZTogJ293bmNsb3VkL3NlcnZlcjpsYXRlc3QnCiAgICBkZXBlbmRzX29uOgogICAgICBtYXJpYWRiOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIHJlZGlzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX1VSTF9PV05DTE9VRF84MDgwCiAgICAgIC0gJ09XTkNMT1VEX0RPTUFJTj0ke1NFUlZJQ0VfRlFETl9PV05DTE9VRH0nCiAgICAgIC0gJ09XTkNMT1VEX1RSVVNURURfRE9NQUlOUz0ke1NFUlZJQ0VfRlFETl9PV05DTE9VRH0nCiAgICAgIC0gT1dOQ0xPVURfREJfVFlQRT1teXNxbAogICAgICAtIE9XTkNMT1VEX0RCX0hPU1Q9bWFyaWFkYgogICAgICAtICdPV05DTE9VRF9EQl9OQU1FPSR7REJfTkFNRTotb3duY2xvdWR9JwogICAgICAtICdPV05DTE9VRF9EQl9VU0VSTkFNRT0ke1NFUlZJQ0VfVVNFUl9NQVJJQURCfScKICAgICAgLSAnT1dOQ0xPVURfREJfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX01BUklBREJ9JwogICAgICAtICdPV05DTE9VRF9BRE1JTl9VU0VSTkFNRT0ke1NFUlZJQ0VfVVNFUl9PV05DTE9VRH0nCiAgICAgIC0gJ09XTkNMT1VEX0FETUlOX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9PV05DTE9VRH0nCiAgICAgIC0gJ09XTkNMT1VEX01ZU1FMX1VURjhNQjQ9JHtNWVNRTF9VVEY4TUI0Oi10cnVlfScKICAgICAgLSAnT1dOQ0xPVURfUkVESVNfRU5BQkxFRD0ke1JFRElTX0VOQUJMRUQ6LXRydWV9JwogICAgICAtIE9XTkNMT1VEX1JFRElTX0hPU1Q9cmVkaXMKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSAvdXNyL2Jpbi9oZWFsdGhjaGVjawogICAgICBpbnRlcnZhbDogMzBzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiA1CiAgICB2b2x1bWVzOgogICAgICAtICdvd25jbG91ZC1kYXRhOi9tbnQvZGF0YScKICBtYXJpYWRiOgogICAgaW1hZ2U6ICdtYXJpYWRiOmxhdGVzdCcKICAgIGVudmlyb25tZW50OgogICAgICAtICdNWVNRTF9ST09UX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9NQVJJQURCUk9PVH0nCiAgICAgIC0gJ01ZU1FMX1VTRVI9JHtTRVJWSUNFX1VTRVJfTUFSSUFEQn0nCiAgICAgIC0gJ01ZU1FMX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9NQVJJQURCfScKICAgICAgLSAnTVlTUUxfREFUQUJBU0U9JHtEQl9OQU1FOi1vd25jbG91ZH0nCiAgICAgIC0gVFo9YXV0bwogICAgY29tbWFuZDoKICAgICAgLSAnLS1jaGFyYWN0ZXItc2V0LXNlcnZlcj11dGY4bWI0JwogICAgICAtICctLWNvbGxhdGlvbi1zZXJ2ZXI9dXRmOG1iNF9iaW4nCiAgICAgIC0gJy0tbWF4LWFsbG93ZWQtcGFja2V0PTEyOE0nCiAgICAgIC0gJy0taW5ub2RiLWxvZy1maWxlLXNpemU9NjRNJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGhlYWx0aGNoZWNrLnNoCiAgICAgICAgLSAnLS1jb25uZWN0JwogICAgICAgIC0gJy0taW5ub2RiX2luaXRpYWxpemVkJwogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMjBzCiAgICAgIHJldHJpZXM6IDEwCiAgICB2b2x1bWVzOgogICAgICAtICdvd25jbG91ZC1teXNxbC1kYXRhOi92YXIvbGliL215c3FsJwogIHJlZGlzOgogICAgaW1hZ2U6ICdyZWRpczo2JwogICAgY29tbWFuZDoKICAgICAgLSAnLS1kYXRhYmFzZXMnCiAgICAgIC0gJzEnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gcmVkaXMtY2xpCiAgICAgICAgLSBwaW5nCiAgICAgIGludGVydmFsOiAxMHMKICAgICAgdGltZW91dDogNXMKICAgICAgcmV0cmllczogNQo=",
         "tags": [
             "owncloud",
             "file-management",
diff --git a/templates/service-templates.json b/templates/service-templates.json
index 699b97e55..26aed5826 100644
--- a/templates/service-templates.json
+++ b/templates/service-templates.json
@@ -1620,7 +1620,7 @@
     "garage": {
         "documentation": "https://garagehq.deuxfleurs.fr/documentation/?utm_source=coolify.io",
         "slogan": "Garage is an S3-compatible distributed object storage service designed for self-hosting.",
-        "compose": "c2VydmljZXM6CiAgZ2FyYWdlOgogICAgaW1hZ2U6ICdkeGZscnMvZ2FyYWdlOnYyLjEuMCcKICAgIGVudmlyb25tZW50OgogICAgICAtIEdBUkFHRV9TM19BUElfVVJMPSRHQVJBR0VfUzNfQVBJX1VSTAogICAgICAtIEdBUkFHRV9XRUJfVVJMPSRHQVJBR0VfV0VCX1VSTAogICAgICAtIEdBUkFHRV9BRE1JTl9VUkw9JEdBUkFHRV9BRE1JTl9VUkwKICAgICAgLSAnR0FSQUdFX1JQQ19TRUNSRVQ9JHtTRVJWSUNFX0hFWF8zMl9SUENTRUNSRVR9JwogICAgICAtIEdBUkFHRV9BRE1JTl9UT0tFTj0kU0VSVklDRV9QQVNTV09SRF9HQVJBR0UKICAgICAgLSBHQVJBR0VfTUVUUklDU19UT0tFTj0kU0VSVklDRV9QQVNTV09SRF9HQVJBR0VNRVRSSUNTCiAgICAgIC0gR0FSQUdFX0FMTE9XX1dPUkxEX1JFQURBQkxFX1NFQ1JFVFM9dHJ1ZQogICAgICAtICdSVVNUX0xPRz0ke1JVU1RfTE9HOi1nYXJhZ2U9aW5mb30nCiAgICB2b2x1bWVzOgogICAgICAtICdnYXJhZ2UtbWV0YTovdmFyL2xpYi9nYXJhZ2UvbWV0YScKICAgICAgLSAnZ2FyYWdlLWRhdGE6L3Zhci9saWIvZ2FyYWdlL2RhdGEnCiAgICAgIC0KICAgICAgICB0eXBlOiBiaW5kCiAgICAgICAgc291cmNlOiAuL2dhcmFnZS50b21sCiAgICAgICAgdGFyZ2V0OiAvZXRjL2dhcmFnZS50b21sCiAgICAgICAgY29udGVudDogIm1ldGFkYXRhX2RpciA9IFwiL3Zhci9saWIvZ2FyYWdlL21ldGFcIlxuZGF0YV9kaXIgPSBcIi92YXIvbGliL2dhcmFnZS9kYXRhXCJcbmRiX2VuZ2luZSA9IFwibG1kYlwiXG5cbnJlcGxpY2F0aW9uX2ZhY3RvciA9IDFcbmNvbnNpc3RlbmN5X21vZGUgPSBcImNvbnNpc3RlbnRcIlxuXG5jb21wcmVzc2lvbl9sZXZlbCA9IDFcbmJsb2NrX3NpemUgPSBcIjFNXCJcblxucnBjX2JpbmRfYWRkciA9IFwiWzo6XTozOTAxXCJcbnJwY19zZWNyZXRfZmlsZSA9IFwiZW52OkdBUkFHRV9SUENfU0VDUkVUXCJcbmJvb3RzdHJhcF9wZWVycyA9IFtdXG5cbltzM19hcGldXG5zM19yZWdpb24gPSBcImdhcmFnZVwiXG5hcGlfYmluZF9hZGRyID0gXCJbOjpdOjM5MDBcIlxucm9vdF9kb21haW4gPSBcIi5zMy5nYXJhZ2UubG9jYWxob3N0XCJcblxuW3MzX3dlYl1cbmJpbmRfYWRkciA9IFwiWzo6XTozOTAyXCJcbnJvb3RfZG9tYWluID0gXCIud2ViLmdhcmFnZS5sb2NhbGhvc3RcIlxuXG5bYWRtaW5dXG5hcGlfYmluZF9hZGRyID0gXCJbOjpdOjM5MDNcIlxuYWRtaW5fdG9rZW5fZmlsZSA9IFwiZW52OkdBUkFHRV9BRE1JTl9UT0tFTlwiXG5tZXRyaWNzX3Rva2VuX2ZpbGUgPSBcImVudjpHQVJBR0VfTUVUUklDU19UT0tFTlwiIgogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIC9nYXJhZ2UKICAgICAgICAtIHN0YXRzCiAgICAgICAgLSAnLWEnCiAgICAgIGludGVydmFsOiAxMHMKICAgICAgdGltZW91dDogNXMKICAgICAgcmV0cmllczogNQo=",
+        "compose": "c2VydmljZXM6CiAgZ2FyYWdlOgogICAgaW1hZ2U6ICdkeGZscnMvZ2FyYWdlOnYyLjEuMCcKICAgIGVudmlyb25tZW50OgogICAgICAtIEdBUkFHRV9TM19BUElfVVJMPSRHQVJBR0VfUzNfQVBJX1VSTAogICAgICAtIEdBUkFHRV9XRUJfVVJMPSRHQVJBR0VfV0VCX1VSTAogICAgICAtIEdBUkFHRV9BRE1JTl9VUkw9JEdBUkFHRV9BRE1JTl9VUkwKICAgICAgLSAnR0FSQUdFX1JQQ19TRUNSRVQ9JHtTRVJWSUNFX0hFWF82NF9SUENTRUNSRVR9JwogICAgICAtIEdBUkFHRV9BRE1JTl9UT0tFTj0kU0VSVklDRV9QQVNTV09SRF9HQVJBR0UKICAgICAgLSBHQVJBR0VfTUVUUklDU19UT0tFTj0kU0VSVklDRV9QQVNTV09SRF9HQVJBR0VNRVRSSUNTCiAgICAgIC0gR0FSQUdFX0FMTE9XX1dPUkxEX1JFQURBQkxFX1NFQ1JFVFM9dHJ1ZQogICAgICAtICdSVVNUX0xPRz0ke1JVU1RfTE9HOi1nYXJhZ2U9aW5mb30nCiAgICB2b2x1bWVzOgogICAgICAtICdnYXJhZ2UtbWV0YTovdmFyL2xpYi9nYXJhZ2UvbWV0YScKICAgICAgLSAnZ2FyYWdlLWRhdGE6L3Zhci9saWIvZ2FyYWdlL2RhdGEnCiAgICAgIC0KICAgICAgICB0eXBlOiBiaW5kCiAgICAgICAgc291cmNlOiAuL2dhcmFnZS50b21sCiAgICAgICAgdGFyZ2V0OiAvZXRjL2dhcmFnZS50b21sCiAgICAgICAgY29udGVudDogIm1ldGFkYXRhX2RpciA9IFwiL3Zhci9saWIvZ2FyYWdlL21ldGFcIlxuZGF0YV9kaXIgPSBcIi92YXIvbGliL2dhcmFnZS9kYXRhXCJcbmRiX2VuZ2luZSA9IFwibG1kYlwiXG5cbnJlcGxpY2F0aW9uX2ZhY3RvciA9IDFcbmNvbnNpc3RlbmN5X21vZGUgPSBcImNvbnNpc3RlbnRcIlxuXG5jb21wcmVzc2lvbl9sZXZlbCA9IDFcbmJsb2NrX3NpemUgPSBcIjFNXCJcblxucnBjX2JpbmRfYWRkciA9IFwiWzo6XTozOTAxXCJcbnJwY19zZWNyZXRfZmlsZSA9IFwiZW52OkdBUkFHRV9SUENfU0VDUkVUXCJcbmJvb3RzdHJhcF9wZWVycyA9IFtdXG5cbltzM19hcGldXG5zM19yZWdpb24gPSBcImdhcmFnZVwiXG5hcGlfYmluZF9hZGRyID0gXCJbOjpdOjM5MDBcIlxucm9vdF9kb21haW4gPSBcIi5zMy5nYXJhZ2UubG9jYWxob3N0XCJcblxuW3MzX3dlYl1cbmJpbmRfYWRkciA9IFwiWzo6XTozOTAyXCJcbnJvb3RfZG9tYWluID0gXCIud2ViLmdhcmFnZS5sb2NhbGhvc3RcIlxuXG5bYWRtaW5dXG5hcGlfYmluZF9hZGRyID0gXCJbOjpdOjM5MDNcIlxuYWRtaW5fdG9rZW5fZmlsZSA9IFwiZW52OkdBUkFHRV9BRE1JTl9UT0tFTlwiXG5tZXRyaWNzX3Rva2VuX2ZpbGUgPSBcImVudjpHQVJBR0VfTUVUUklDU19UT0tFTlwiIgogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIC9nYXJhZ2UKICAgICAgICAtIHN0YXRzCiAgICAgICAgLSAnLWEnCiAgICAgIGludGVydmFsOiAxMHMKICAgICAgdGltZW91dDogNXMKICAgICAgcmV0cmllczogNQo=",
         "tags": [
             "object",
             "storage",
@@ -1666,7 +1666,7 @@
     "gitea-runner": {
         "documentation": "https://github.com/go-gitea/gitea?utm_source=coolify.io",
         "slogan": "Gitea Actions runner for docker",
-        "compose": "c2VydmljZXM6CiAgcnVubmVyOgogICAgaW1hZ2U6ICdkb2NrZXIuaW8vZ2l0ZWEvcnVubmVyOjEuMC42JwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ0dJVEVBX0lOU1RBTkNFX1VSTD0ke0dJVEVBX0lOU1RBTkNFX1VSTH0nCiAgICAgIC0gJ0dJVEVBX1JVTk5FUl9SRUdJU1RSQVRJT05fVE9LRU49JHtHSVRFQV9SVU5ORVJfUkVHSVNUUkFUSU9OX1RPS0VOfScKICAgICAgLSAnR0lURUFfUlVOTkVSX05BTUU9JHtHSVRFQV9SVU5ORVJfTkFNRTotZ2l0ZWEtcnVubmVyfScKICAgICAgLSAnR0lURUFfUlVOTkVSX0xBQkVMUz0ke0dJVEVBX1JVTk5FUl9MQUJFTFM6LXVidW50dS1sYXRlc3Q6ZG9ja2VyOi8vbm9kZToyMn0nCiAgICAgIC0gJ0dJVEVBX1RPS0VOPSR7R0lURUFfVE9LRU59JwogICAgd29ya2luZ19kaXI6IC9kYXRhCiAgICB2b2x1bWVzOgogICAgICAtICdydW5uZXItZGF0YTovZGF0YScKICAgICAgLSAnL3Zhci9ydW4vZG9ja2VyLnNvY2s6L3Zhci9ydW4vZG9ja2VyLnNvY2snCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRC1TSEVMTAogICAgICAgIC0gInBzIGF1eCB8IGdyZXAgJ1tSXXVubmVyJyA+IC9kZXYvbnVsbCB8fCBleGl0IDEiCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMTUK",
+        "compose": "c2VydmljZXM6CiAgcnVubmVyOgogICAgaW1hZ2U6ICdkb2NrZXIuaW8vZ2l0ZWEvcnVubmVyOjEuMC43JwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ0dJVEVBX0lOU1RBTkNFX1VSTD0ke0dJVEVBX0lOU1RBTkNFX1VSTH0nCiAgICAgIC0gJ0dJVEVBX1JVTk5FUl9SRUdJU1RSQVRJT05fVE9LRU49JHtHSVRFQV9SVU5ORVJfUkVHSVNUUkFUSU9OX1RPS0VOfScKICAgICAgLSAnR0lURUFfUlVOTkVSX05BTUU9JHtHSVRFQV9SVU5ORVJfTkFNRTotZ2l0ZWEtcnVubmVyfScKICAgICAgLSAnR0lURUFfUlVOTkVSX0xBQkVMUz0ke0dJVEVBX1JVTk5FUl9MQUJFTFM6LXVidW50dS1sYXRlc3Q6ZG9ja2VyOi8vbm9kZToyMn0nCiAgICAgIC0gJ0dJVEVBX1RPS0VOPSR7R0lURUFfVE9LRU59JwogICAgd29ya2luZ19kaXI6IC9kYXRhCiAgICB2b2x1bWVzOgogICAgICAtICdydW5uZXItZGF0YTovZGF0YScKICAgICAgLSAnL3Zhci9ydW4vZG9ja2VyLnNvY2s6L3Zhci9ydW4vZG9ja2VyLnNvY2snCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRC1TSEVMTAogICAgICAgIC0gInBzIGF1eCB8IGdyZXAgJ1tSXXVubmVyJyA+IC9kZXYvbnVsbCB8fCBleGl0IDEiCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMTUK",
         "tags": [
             "gitea",
             "actions",
@@ -2007,6 +2007,24 @@
         "minversion": "0.0.0",
         "port": "80"
     },
+    "healthchecks": {
+        "documentation": "https://healthchecks.io/docs?utm_source=coolify.io",
+        "slogan": "Healthchecks is a cron job monitoring service. It listens for HTTP requests and email messages from your cron jobs and scheduled tasks.",
+        "compose": "c2VydmljZXM6CiAgaGVhbHRoY2hlY2tzOgogICAgaW1hZ2U6ICdoZWFsdGhjaGVja3MvaGVhbHRoY2hlY2tzOnY0LjInCiAgICBjb250YWluZXJfbmFtZTogaGVhbHRoY2hlY2tzCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX0ZRRE5fSEVBTFRIQ0hFQ0tTXzgwMDAKICAgICAgLSBEQj1zcWxpdGUKICAgICAgLSBEQl9OQU1FPS9kYXRhL2hjLnNxbGl0ZQogICAgICAtICdBTExPV0VEX0hPU1RTPSR7QUxMT1dFRF9IT1NUUzotKn0nCiAgICAgIC0gJ1JFR0lTVFJBVElPTl9PUEVOPSR7UkVHSVNUUkFUSU9OX09QRU46LVRydWV9JwogICAgICAtICdERUJVRz0ke0RFQlVHOi1GYWxzZX0nCiAgICAgIC0gJ1NFQ1JFVF9LRVk9JHtTRUNSRVRfS0VZOj8ke1NFUlZJQ0VfUEFTU1dPUkRfNjRfSEVBTFRIQ0hFQ0tTfX0nCiAgICAgIC0gJ1NJVEVfUk9PVD0ke1NFUlZJQ0VfRlFETl9IRUFMVEhDSEVDS1N9JwogICAgICAtICdERUZBVUxUX0ZST01fRU1BSUw9JHtERUZBVUxUX0ZST01fRU1BSUw6LWZpeG1lLWVtYWlsLWFkZHJlc3MtaGVyZX0nCiAgICAgIC0gJ0VNQUlMX0hPU1Q9JHtFTUFJTF9IT1NUOi1teS1zbXRwLXNlcnZlci1oZXJlLmNvbX0nCiAgICAgIC0gJ0VNQUlMX1BPUlQ9JHtFTUFJTF9QT1JUOi00NjV9JwogICAgICAtICdFTUFJTF9IT1NUX1VTRVI9JHtFTUFJTF9IT1NUX1VTRVI6LW15X3VzZXJuYW1lfScKICAgICAgLSAnRU1BSUxfSE9TVF9QQVNTV09SRD0ke0VNQUlMX0hPU1RfUEFTU1dPUkQ6LW15cGFzc3dvcmR9JwogICAgICAtICdFTUFJTF9VU0VfU1NMPSR7RU1BSUxfVVNFX1NTTDotVHJ1ZX0nCiAgICAgIC0gJ0VNQUlMX1VTRV9UTFM9JHtFTUFJTF9VU0VfVExTOi1GYWxzZX0nCiAgICB2b2x1bWVzOgogICAgICAtICdoZWFsdGhjaGVja3MtZGF0YTovZGF0YScK",
+        "tags": [
+            "monitoring",
+            "status",
+            "performance",
+            "web",
+            "services",
+            "applications",
+            "real-time"
+        ],
+        "category": "monitoring",
+        "logo": "svgs/healthchecks.webp",
+        "minversion": "0.0.0",
+        "port": "80000"
+    },
     "heimdall": {
         "documentation": "https://github.com/linuxserver/Heimdall?utm_source=coolify.io",
         "slogan": "Heimdall is a dashboard for managing and organizing your server applications.",
diff --git a/tests/Feature/Application/GithubSourceChangeTest.php b/tests/Feature/Application/GithubSourceChangeTest.php
index 91296dd0f..07bc2a2c3 100644
--- a/tests/Feature/Application/GithubSourceChangeTest.php
+++ b/tests/Feature/Application/GithubSourceChangeTest.php
@@ -7,6 +7,8 @@
 use App\Models\Team;
 use App\Models\User;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\Http;
 use Livewire\Livewire;
 
 uses(RefreshDatabase::class);
@@ -84,6 +86,67 @@ function validPrivateKey(): string
             ->assertSet('privateKeyId', null);
     });
 
+    test('creates one-time states for manifest conversion and installation callbacks', function () {
+        $githubApp = GithubApp::create([
+            'name' => 'Test GitHub App',
+            'api_url' => 'https://api.github.com',
+            'html_url' => 'https://github.com',
+            'custom_user' => 'git',
+            'custom_port' => 22,
+            'team_id' => $this->team->id,
+            'is_system_wide' => false,
+        ]);
+
+        $component = Livewire::withQueryParams(['github_app_uuid' => $githubApp->uuid])
+            ->test(Change::class)
+            ->assertSuccessful();
+
+        $manifestState = $component->get('manifestState');
+        $installationUrl = getInstallationPath($githubApp);
+        parse_str(parse_url($installationUrl, PHP_URL_QUERY), $query);
+        $installState = $query['state'] ?? null;
+
+        expect($manifestState)->not->toBeEmpty()
+            ->and($installState)->not->toBeEmpty()
+            ->and($installState)->not->toBe($manifestState)
+            ->and($installationUrl)->not->toContain($githubApp->uuid)
+            ->and(Cache::get('github-app-setup-state:'.hash('sha256', $manifestState)))
+            ->toMatchArray([
+                'action' => 'manifest',
+                'github_app_id' => $githubApp->id,
+                'team_id' => $githubApp->team_id,
+            ])
+            ->and(Cache::get('github-app-setup-state:'.hash('sha256', $installState)))
+            ->toMatchArray([
+                'action' => 'install',
+                'github_app_id' => $githubApp->id,
+                'team_id' => $githubApp->team_id,
+            ]);
+    });
+
+    test('installation path is generated from the provided github app instance', function () {
+        $githubApp = new GithubApp;
+        $githubApp->forceFill([
+            'id' => 123,
+            'name' => 'Provided GitHub App',
+            'html_url' => 'https://github.example.com',
+            'team_id' => 456,
+        ]);
+
+        $installationUrl = getInstallationPath($githubApp);
+        parse_str(parse_url($installationUrl, PHP_URL_QUERY), $query);
+        $installState = $query['state'] ?? null;
+
+        expect($installationUrl)->toStartWith('https://github.example.com/github-apps/provided-git-hub-app/installations/new?')
+            ->and($installState)->not->toBeEmpty()
+            ->and(Cache::get('github-app-setup-state:'.hash('sha256', $installState)))
+            ->toMatchArray([
+                'action' => 'install',
+                'github_app_id' => 123,
+                'team_id' => 456,
+            ]);
+    });
+
     test('defaults webhook endpoint to app url when it is the first available endpoint', function () {
         config(['app.url' => 'http://localhost:8000']);
 
@@ -305,4 +368,65 @@ function validPrivateKey(): string
                 return str_contains($message, 'Private Key not found');
             });
     });
+
+    test('checkPermissions syncs refetched permissions into input fields', function () {
+        $privateKey = PrivateKey::create([
+            'name' => 'Test Key',
+            'private_key' => validPrivateKey(),
+            'team_id' => $this->team->id,
+        ]);
+
+        $githubApp = GithubApp::create([
+            'name' => 'Test GitHub App',
+            'api_url' => 'https://api.github.com',
+            'html_url' => 'https://github.com',
+            'custom_user' => 'git',
+            'custom_port' => 22,
+            'app_id' => 12345,
+            'installation_id' => 67890,
+            'client_id' => 'test-client-id',
+            'client_secret' => 'test-client-secret',
+            'webhook_secret' => 'test-webhook-secret',
+            'private_key_id' => $privateKey->id,
+            'team_id' => $this->team->id,
+            'is_system_wide' => false,
+            'contents' => null,
+            'metadata' => null,
+            'pull_requests' => null,
+        ]);
+
+        Http::preventStrayRequests();
+        Http::fake([
+            'https://api.github.com/zen' => Http::response('Keep it logically awesome.', 200, [
+                'date' => now()->toRfc7231String(),
+            ]),
+            'https://api.github.com/app' => Http::response([
+                'permissions' => [
+                    'contents' => 'read',
+                    'metadata' => 'read',
+                    'pull_requests' => 'write',
+                ],
+            ]),
+        ]);
+
+        Livewire::withQueryParams(['github_app_uuid' => $githubApp->uuid])
+            ->test(Change::class)
+            ->assertSuccessful()
+            ->assertSet('name', 'test-git-hub-app')
+            ->assertSet('contents', null)
+            ->assertSet('metadata', null)
+            ->assertSet('pullRequests', null)
+            ->call('checkPermissions')
+            ->assertDispatched('success')
+            ->assertSet('name', 'test-git-hub-app')
+            ->assertSet('contents', 'read')
+            ->assertSet('metadata', 'read')
+            ->assertSet('pullRequests', 'write');
+
+        $githubApp->refresh();
+
+        expect($githubApp->contents)->toBe('read')
+            ->and($githubApp->metadata)->toBe('read')
+            ->and($githubApp->pull_requests)->toBe('write');
+    });
 });
diff --git a/tests/Feature/ApplicationStoppedAfterRestartLimitTest.php b/tests/Feature/ApplicationStoppedAfterRestartLimitTest.php
new file mode 100644
index 000000000..6b82d5568
--- /dev/null
+++ b/tests/Feature/ApplicationStoppedAfterRestartLimitTest.php
@@ -0,0 +1,82 @@
+<?php
+
+use App\Actions\Application\StopApplication;
+use App\Models\Application;
+use App\Notifications\Application\RestartLimitReached;
+
+function applicationWithRestartState(array $attributes = []): Application
+{
+    $application = new Application;
+    $application->forceFill(array_merge([
+        'status' => 'exited:unhealthy',
+        'restart_count' => 2,
+        'max_restart_count' => 2,
+        'last_restart_type' => 'crash',
+        'last_restart_at' => now(),
+    ], $attributes));
+
+    return $application;
+}
+
+it('detects applications stopped after reaching the crash restart limit', function () {
+    expect(applicationWithRestartState()->stoppedAfterRestartLimit())->toBeTrue()
+        ->and(applicationWithRestartState(['status' => 'running:unhealthy'])->stoppedAfterRestartLimit())->toBeFalse()
+        ->and(applicationWithRestartState(['restart_count' => 1])->stoppedAfterRestartLimit())->toBeFalse()
+        ->and(applicationWithRestartState(['max_restart_count' => 0])->stoppedAfterRestartLimit())->toBeFalse()
+        ->and(applicationWithRestartState(['last_restart_type' => null])->stoppedAfterRestartLimit())->toBeFalse();
+});
+
+it('shows a stopped after restart limit warning in the status badge', function () {
+    $html = view('components.status.index', [
+        'resource' => applicationWithRestartState(),
+        'showRefreshButton' => false,
+    ])->render();
+
+    expect($html)->toContain('Stopped after reaching restart limit (2/2).')
+        ->and($html)->toContain('Container has crashed and Coolify stopped it after 2 restart attempts.');
+});
+
+it('does not show the restart limit warning for a normal manual stop', function () {
+    $html = view('components.status.index', [
+        'resource' => applicationWithRestartState([
+            'restart_count' => 0,
+            'last_restart_type' => null,
+        ]),
+        'showRefreshButton' => false,
+    ])->render();
+
+    expect($html)->not->toContain('Stopped after reaching restart limit');
+});
+
+it('keeps restart tracking configurable when stopping an application', function () {
+    $method = new ReflectionMethod(StopApplication::class, 'handle');
+    $resetRestartCount = collect($method->getParameters())->firstWhere('name', 'resetRestartCount');
+
+    expect($resetRestartCount)->not->toBeNull()
+        ->and($resetRestartCount->getDefaultValue())->toBeTrue();
+});
+
+it('uses the application link for restart limit notifications', function () {
+    $application = new class extends Application
+    {
+        public function link()
+        {
+            return 'https://coolify.test/project/link-from-model';
+        }
+    };
+    $application->forceFill([
+        'name' => 'crashy-app',
+        'uuid' => 'application-uuid',
+        'restart_count' => 2,
+        'max_restart_count' => 2,
+    ]);
+    $application->setRelation('environment', (object) [
+        'uuid' => 'environment-uuid',
+        'name' => 'production',
+        'project' => (object) ['uuid' => 'project-uuid'],
+    ]);
+
+    $notification = new RestartLimitReached($application);
+
+    expect($notification->resource_url)->toBe('https://coolify.test/project/link-from-model');
+});
diff --git a/tests/Feature/EnvironmentVariableMultilineToggleViewTest.php b/tests/Feature/EnvironmentVariableMultilineToggleViewTest.php
index e27fd0b4b..de97e6095 100644
--- a/tests/Feature/EnvironmentVariableMultilineToggleViewTest.php
+++ b/tests/Feature/EnvironmentVariableMultilineToggleViewTest.php
@@ -29,3 +29,28 @@
         ->not->toContain('wire:model="variables" monospace')
         ->not->toContain('wire:model="variablesPreview" monospace');
 });
+
+it('renders the environment variable search field above the production title', function () {
+    $view = file_get_contents(resource_path('views/livewire/project/shared/environment-variable/all.blade.php'));
+
+    expect(strpos($view, 'aria-label="Search environment variables"'))
+        ->toBeLessThan(strpos($view, '<h3>Production Environment Variables</h3>'));
+});
+
+it('renders a single no results message for empty environment variable searches', function () {
+    $view = file_get_contents(resource_path('views/livewire/project/shared/environment-variable/all.blade.php'));
+
+    expect($view)
+        ->toContain('@if ($this->isSearchActive && ! $this->hasEnvironmentVariables)')
+        ->toContain('<div>No environment variables found.</div>')
+        ->toContain('@else');
+});
+
+it('only renders the production section when production variables are visible', function () {
+    $view = file_get_contents(resource_path('views/livewire/project/shared/environment-variable/all.blade.php'));
+
+    expect($view)
+        ->toContain('@if ($this->environmentVariables->isNotEmpty() || $this->hardcodedEnvironmentVariables->isNotEmpty())')
+        ->not->toContain('@forelse ($this->environmentVariables as $env)')
+        ->not->toContain('@empty');
+});
diff --git a/tests/Feature/EnvironmentVariableSearchTest.php b/tests/Feature/EnvironmentVariableSearchTest.php
new file mode 100644
index 000000000..613144d53
--- /dev/null
+++ b/tests/Feature/EnvironmentVariableSearchTest.php
@@ -0,0 +1,251 @@
+<?php
+
+use App\Livewire\Project\Shared\EnvironmentVariable\All;
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\EnvironmentVariable;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Service;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::forceCreate(['id' => 0]);
+
+    $this->user = User::factory()->create();
+    $this->team = Team::factory()->create();
+    $this->team->members()->attach($this->user, ['role' => 'owner']);
+    $this->project = Project::factory()->create([
+        'team_id' => $this->team->id,
+    ]);
+    $this->environment = Environment::factory()->create([
+        'project_id' => $this->project->id,
+    ]);
+
+    $this->actingAs($this->user);
+});
+
+it('filters production environment variables by key case-insensitively', function () {
+    $application = Application::factory()->create([
+        'environment_id' => $this->environment->id,
+    ]);
+
+    EnvironmentVariable::create([
+        'key' => 'API_KEY',
+        'value' => 'secret',
+        'resourceable_type' => Application::class,
+        'resourceable_id' => $application->id,
+    ]);
+
+    EnvironmentVariable::create([
+        'key' => 'DATABASE_URL',
+        'value' => 'postgres://example',
+        'resourceable_type' => Application::class,
+        'resourceable_id' => $application->id,
+    ]);
+
+    $component = Livewire::test(All::class, ['resource' => $application])
+        ->set('search', 'api');
+
+    expect($component->instance()->environmentVariables->pluck('key')->all())
+        ->toBe(['API_KEY']);
+});
+
+it('treats production environment variable search wildcards literally', function () {
+    $application = Application::factory()->create([
+        'environment_id' => $this->environment->id,
+    ]);
+
+    EnvironmentVariable::create([
+        'key' => 'API_KEY',
+        'value' => 'secret',
+        'resourceable_type' => Application::class,
+        'resourceable_id' => $application->id,
+    ]);
+
+    EnvironmentVariable::create([
+        'key' => 'APIXKEY',
+        'value' => 'other-secret',
+        'resourceable_type' => Application::class,
+        'resourceable_id' => $application->id,
+    ]);
+
+    EnvironmentVariable::create([
+        'key' => 'PERCENT%KEY',
+        'value' => 'percent-secret',
+        'resourceable_type' => Application::class,
+        'resourceable_id' => $application->id,
+    ]);
+
+    $component = Livewire::test(All::class, ['resource' => $application])
+        ->set('search', 'api_key');
+
+    expect($component->instance()->environmentVariables->pluck('key')->all())
+        ->toBe(['API_KEY']);
+
+    $component->set('search', '%KEY');
+
+    expect($component->instance()->environmentVariables->pluck('key')->all())
+        ->toBe(['PERCENT%KEY']);
+});
+
+it('filters preview environment variables by key case-insensitively', function () {
+    $application = Application::factory()->create([
+        'environment_id' => $this->environment->id,
+    ]);
+
+    EnvironmentVariable::create([
+        'key' => 'PREVIEW_TOKEN',
+        'value' => 'preview-secret',
+        'is_preview' => true,
+        'resourceable_type' => Application::class,
+        'resourceable_id' => $application->id,
+    ]);
+
+    EnvironmentVariable::create([
+        'key' => 'OTHER_PREVIEW_VALUE',
+        'value' => 'preview-other',
+        'is_preview' => true,
+        'resourceable_type' => Application::class,
+        'resourceable_id' => $application->id,
+    ]);
+
+    $component = Livewire::test(All::class, ['resource' => $application])
+        ->set('search', 'token');
+
+    expect($component->instance()->environmentVariablesPreview->pluck('key')->all())
+        ->toBe(['PREVIEW_TOKEN']);
+});
+
+it('filters hardcoded Docker Compose environment variables by key case-insensitively', function () {
+    $service = Service::factory()->create([
+        'environment_id' => $this->environment->id,
+        'docker_compose_raw' => <<<'YAML'
+services:
+  app:
+    image: nginx
+    environment:
+      API_TOKEN: hardcoded-secret
+      DATABASE_URL: postgres://example
+YAML,
+    ]);
+
+    $component = Livewire::test(All::class, ['resource' => $service])
+        ->set('search', 'api');
+
+    expect($component->instance()->hardcodedEnvironmentVariables->pluck('key')->all())
+        ->toBe(['API_TOKEN']);
+});
+
+it('does not show the empty production message when search only matches hardcoded variables', function () {
+    $service = Service::factory()->create([
+        'environment_id' => $this->environment->id,
+        'docker_compose_raw' => <<<'YAML'
+services:
+  app:
+    image: nginx
+    environment:
+      API_TOKEN: hardcoded-secret
+      DATABASE_URL: postgres://example
+YAML,
+    ]);
+
+    Livewire::test(All::class, ['resource' => $service])
+        ->set('search', 'api')
+        ->assertSee('Production Environment Variables')
+        ->assertSee('API_TOKEN')
+        ->assertDontSee('No environment variables found.');
+});
+
+it('keeps developer view unfiltered after searching', function () {
+    $application = Application::factory()->create([
+        'environment_id' => $this->environment->id,
+    ]);
+
+    EnvironmentVariable::create([
+        'key' => 'API_KEY',
+        'value' => 'secret',
+        'resourceable_type' => Application::class,
+        'resourceable_id' => $application->id,
+    ]);
+
+    EnvironmentVariable::create([
+        'key' => 'DATABASE_URL',
+        'value' => 'postgres://example',
+        'resourceable_type' => Application::class,
+        'resourceable_id' => $application->id,
+    ]);
+
+    $component = Livewire::test(All::class, ['resource' => $application])
+        ->set('search', 'api')
+        ->call('switch')
+        ->assertSet('view', 'dev');
+
+    expect($component->get('variables'))
+        ->toContain('API_KEY=secret')
+        ->toContain('DATABASE_URL=postgres://example');
+});
+
+it('does not delete non-matching variables when saving developer view after searching', function () {
+    $application = Application::factory()->create([
+        'environment_id' => $this->environment->id,
+    ]);
+
+    EnvironmentVariable::create([
+        'key' => 'API_KEY',
+        'value' => 'secret',
+        'resourceable_type' => Application::class,
+        'resourceable_id' => $application->id,
+    ]);
+
+    EnvironmentVariable::create([
+        'key' => 'DATABASE_URL',
+        'value' => 'postgres://example',
+        'resourceable_type' => Application::class,
+        'resourceable_id' => $application->id,
+    ]);
+
+    Livewire::test(All::class, ['resource' => $application])
+        ->set('search', 'api')
+        ->call('switch')
+        ->call('submit');
+
+    expect($application->environment_variables()->pluck('key')->all())
+        ->toContain('API_KEY')
+        ->toContain('DATABASE_URL');
+});
+
+it('hides the preview section when search filters out all preview variables', function () {
+    $application = Application::factory()->create([
+        'environment_id' => $this->environment->id,
+    ]);
+
+    EnvironmentVariable::create([
+        'key' => 'API_KEY',
+        'value' => 'secret',
+        'resourceable_type' => Application::class,
+        'resourceable_id' => $application->id,
+    ]);
+
+    $application->environment_variables_preview()->where('key', 'API_KEY')->delete();
+
+    EnvironmentVariable::create([
+        'key' => 'PREVIEW_TOKEN',
+        'value' => 'preview-secret',
+        'is_preview' => true,
+        'resourceable_type' => Application::class,
+        'resourceable_id' => $application->id,
+    ]);
+
+    Livewire::test(All::class, ['resource' => $application])
+        ->set('search', 'api')
+        ->assertSee('Production Environment Variables')
+        ->assertSee('API_KEY')
+        ->assertDontSee('Preview Deployments Environment Variables')
+        ->assertDontSee('PREVIEW_TOKEN');
+});
diff --git a/tests/Feature/GitHttpTransportCommandsTest.php b/tests/Feature/GitHttpTransportCommandsTest.php
new file mode 100644
index 000000000..d6f9f1337
--- /dev/null
+++ b/tests/Feature/GitHttpTransportCommandsTest.php
@@ -0,0 +1,136 @@
+<?php
+
+use App\Models\Application;
+use App\Models\ApplicationSetting;
+use App\Models\GithubApp;
+use App\Models\PrivateKey;
+
+function applicationWithGitSettings(bool $shallow = true): Application
+{
+    $application = new Application;
+    $application->forceFill([
+        'uuid' => 'test-app-uuid',
+        'git_repository' => 'coollabsio/private-app',
+        'git_branch' => 'main',
+        'git_commit_sha' => 'HEAD',
+    ]);
+
+    $settings = new ApplicationSetting;
+    $settings->is_git_shallow_clone_enabled = $shallow;
+    $settings->is_git_submodules_enabled = false;
+    $settings->is_git_lfs_enabled = false;
+    $application->setRelation('settings', $settings);
+
+    return $application;
+}
+
+it('uses http 1 transport for public https source clones', function () {
+    $application = applicationWithGitSettings();
+
+    $source = new GithubApp;
+    $source->forceFill([
+        'html_url' => 'https://github.com',
+        'api_url' => 'https://api.github.com',
+        'is_public' => true,
+    ]);
+    $application->setRelation('source', $source);
+
+    $result = $application->generateGitImportCommands(
+        deployment_uuid: 'test-deployment',
+        exec_in_docker: false,
+    );
+
+    expect($result['commands'])
+        ->toContain("git -c http.version=HTTP/1.1 clone --depth=1 -b 'main' 'https://github.com/coollabsio/private-app' '/artifacts/test-deployment'")
+        ->not->toContain('Primary repository import failed, retrying with HTTP/1.1')
+        ->not->toContain('mktemp')
+        ->not->toContain('git_retry_dir');
+});
+
+it('applies http 1 transport to https fetches after clone', function () {
+    $application = applicationWithGitSettings();
+    $application->git_commit_sha = 'abc123def456abc123def456abc123def456abc1';
+
+    $source = new GithubApp;
+    $source->forceFill([
+        'html_url' => 'https://github.com',
+        'api_url' => 'https://api.github.com',
+        'is_public' => true,
+    ]);
+    $application->setRelation('source', $source);
+
+    $result = $application->generateGitImportCommands(
+        deployment_uuid: 'test-deployment',
+        exec_in_docker: false,
+    );
+
+    expect($result['commands'])
+        ->toContain("git -c http.version=HTTP/1.1 fetch --depth=1 origin 'abc123def456abc123def456abc123def456abc1'")
+        ->toContain("git -c http.version=HTTP/1.1 -c advice.detachedHead=false checkout 'abc123def456abc123def456abc123def456abc1'");
+});
+
+it('does not add http transport config to ssh deploy key clones', function () {
+    $application = applicationWithGitSettings();
+    $application->private_key_id = 1;
+    $application->setRelation('private_key', new class extends PrivateKey
+    {
+        public function getAttribute($key)
+        {
+            if ($key === 'private_key') {
+                return 'fake-private-key';
+            }
+
+            return parent::getAttribute($key);
+        }
+    });
+    $application->git_repository = 'git@github.com:coollabsio/private-app.git';
+
+    $result = $application->generateGitImportCommands(
+        deployment_uuid: 'test-deployment',
+        exec_in_docker: false,
+    );
+
+    expect($result['commands'])
+        ->not->toContain('http.version=HTTP/1.1')
+        ->not->toContain('Primary repository import failed, retrying with HTTP/1.1');
+});
+
+it('supports dedicated checkout directories for compose file loading', function () {
+    $application = applicationWithGitSettings();
+
+    $source = new GithubApp;
+    $source->forceFill([
+        'html_url' => 'https://github.com',
+        'api_url' => 'https://api.github.com',
+        'is_public' => true,
+    ]);
+    $application->setRelation('source', $source);
+
+    $result = $application->generateGitImportCommands(
+        deployment_uuid: 'test-deployment',
+        only_checkout: true,
+        exec_in_docker: false,
+        custom_base_dir: 'checkout',
+    );
+
+    expect($result['commands'])
+        ->toContain("git -c http.version=HTTP/1.1 clone --depth=1 --no-checkout -b 'main' 'https://github.com/coollabsio/private-app' 'checkout'")
+        ->not->toContain('mktemp')
+        ->not->toContain('git_retry_dir');
+});
+
+it('applies http 1 transport to custom bitbucket pull request checkout', function () {
+    $application = applicationWithGitSettings();
+    $application->git_repository = 'https://bitbucket.org/coollabsio/private-app.git';
+
+    $result = $application->generateGitImportCommands(
+        deployment_uuid: 'test-deployment',
+        pull_request_id: 123,
+        git_type: 'bitbucket',
+        exec_in_docker: false,
+        commit: 'abc123def456abc123def456abc123def456abc1',
+    );
+
+    expect($result['commands'])
+        ->toContain("git -c http.version=HTTP/1.1 checkout 'abc123def456abc123def456abc123def456abc1'");
+});
diff --git a/tests/Feature/Helpers/DockerCustomCommandsTest.php b/tests/Feature/Helpers/DockerCustomCommandsTest.php
index 74bff2043..299709ffd 100644
--- a/tests/Feature/Helpers/DockerCustomCommandsTest.php
+++ b/tests/Feature/Helpers/DockerCustomCommandsTest.php
@@ -46,6 +46,24 @@
     ]);
 });
 
+test('ConvertDns', function () {
+    $input = '--dns 10.0.0.10 --dns=1.1.1.1';
+    $output = convertDockerRunToCompose($input);
+    expect($output)->toBe([
+        'dns' => ['10.0.0.10', '1.1.1.1'],
+    ]);
+});
+
+test('ConvertDnsWithOtherOptions', function () {
+    $input = '--cap-add=NET_ADMIN --dns 10.0.0.10 --init';
+    $output = convertDockerRunToCompose($input);
+    expect($output)->toBe([
+        'cap_add' => ['NET_ADMIN'],
+        'dns' => ['10.0.0.10'],
+        'init' => true,
+    ]);
+});
+
 test('ConvertPrivilegedAndInit', function () {
     $input = '---privileged --init';
     $output = convertDockerRunToCompose($input);
diff --git a/tests/Feature/InvitationLinkHandlingTest.php b/tests/Feature/InvitationLinkHandlingTest.php
new file mode 100644
index 000000000..e45207cc5
--- /dev/null
+++ b/tests/Feature/InvitationLinkHandlingTest.php
@@ -0,0 +1,131 @@
+<?php
+
+use App\Http\Middleware\CheckForcePasswordReset;
+use App\Http\Middleware\DecideWhatToDoWithUser;
+use App\Models\InstanceSettings;
+use App\Models\Team;
+use App\Models\TeamInvitation;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Config;
+use Illuminate\Support\Facades\Crypt;
+use Illuminate\Support\Facades\Hash;
+use Illuminate\Support\Once;
+use Visus\Cuid2\Cuid2;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    $this->withoutMiddleware([DecideWhatToDoWithUser::class, CheckForcePasswordReset::class]);
+    Once::flush();
+    Config::set('app.maintenance.driver', 'file');
+    Config::set('cache.default', 'array');
+    Config::set('session.driver', 'array');
+
+    if (! InstanceSettings::find(0)) {
+        $settings = new InstanceSettings;
+        $settings->id = 0;
+        $settings->saveQuietly();
+    }
+});
+
+function createInvitationLinkFixture(array $invitationAttributes = []): array
+{
+    $team = Team::factory()->create();
+    $password = 'temporary-password-123';
+    $user = User::factory()->create([
+        'email' => $invitationAttributes['email'] ?? 'invitee@example.com',
+        'password' => Hash::make($password),
+        'force_password_reset' => true,
+        'email_verified_at' => null,
+    ]);
+    $uuid = (string) new Cuid2(32);
+    $token = Crypt::encryptString("{$user->email}@@@{$uuid}@@@{$password}");
+    $link = route('auth.link', ['token' => $token]);
+
+    $invitation = TeamInvitation::create(array_merge([
+        'team_id' => $team->id,
+        'uuid' => $uuid,
+        'email' => $user->email,
+        'role' => 'member',
+        'link' => $link,
+        'via' => 'link',
+    ], $invitationAttributes));
+
+    return [$team, $user, $password, $token, $invitation];
+}
+
+it('accepts a valid magic link invitation only once and rotates the temporary password', function () {
+    [$team, $user, $password, $token] = createInvitationLinkFixture();
+
+    $this->get(route('auth.link', ['token' => $token]))
+        ->assertRedirect(route('dashboard'));
+
+    $this->assertAuthenticatedAs($user);
+    $this->assertDatabaseMissing('team_invitations', ['email' => $user->email]);
+    expect($user->teams()->where('team_id', $team->id)->exists())->toBeTrue();
+
+    $user->refresh();
+    expect(Hash::check($password, $user->password))->toBeFalse();
+
+    auth()->logout();
+    session()->flush();
+
+    $this->get(route('auth.link', ['token' => $token]))
+        ->assertRedirect(route('login'));
+
+    $this->assertGuest();
+});
+
+it('rejects a magic link when the invitation was revoked', function () {
+    [, $user, , $token, $invitation] = createInvitationLinkFixture();
+    $invitation->delete();
+
+    $this->get(route('auth.link', ['token' => $token]))
+        ->assertRedirect(route('login'));
+
+    $this->assertGuest();
+    expect($user->teams()->where('personal_team', false)->exists())->toBeFalse();
+});
+
+it('rejects a magic link when another invitation exists for the same email', function () {
+    [, $user, , $token, $invitation] = createInvitationLinkFixture();
+    $invitation->delete();
+
+    $otherTeam = Team::factory()->create();
+    TeamInvitation::create([
+        'team_id' => $otherTeam->id,
+        'uuid' => (string) new Cuid2(32),
+        'email' => $user->email,
+        'role' => 'admin',
+        'link' => url('/invitations/other-invitation'),
+        'via' => 'link',
+    ]);
+
+    $this->get(route('auth.link', ['token' => $token]))
+        ->assertRedirect(route('login'));
+
+    $this->assertGuest();
+    expect($user->teams()->where('team_id', $otherTeam->id)->exists())->toBeFalse();
+});
+
+it('rejects a magic link when the invitation expired', function () {
+    [, $user, , $token, $invitation] = createInvitationLinkFixture();
+    $invitation->forceFill([
+        'created_at' => now()->subDays(config('constants.invitation.link.expiration_days') + 1),
+        'updated_at' => now()->subDays(config('constants.invitation.link.expiration_days') + 1),
+    ])->save();
+
+    $this->get(route('auth.link', ['token' => $token]))
+        ->assertRedirect(route('login'));
+
+    $this->assertGuest();
+    $this->assertDatabaseMissing('team_invitations', ['id' => $invitation->id]);
+});
+
+it('rejects a malformed magic link token', function () {
+    $this->get(route('auth.link', ['token' => 'not-a-valid-token']))
+        ->assertRedirect(route('login'));
+
+    $this->assertGuest();
+});
diff --git a/tests/Feature/LinkLoginEmailVerificationTest.php b/tests/Feature/LinkLoginEmailVerificationTest.php
index 036584e1e..39ade93eb 100644
--- a/tests/Feature/LinkLoginEmailVerificationTest.php
+++ b/tests/Feature/LinkLoginEmailVerificationTest.php
@@ -4,8 +4,10 @@
 use App\Http\Middleware\DecideWhatToDoWithUser;
 use App\Models\InstanceSettings;
 use App\Models\Team;
+use App\Models\TeamInvitation;
 use App\Models\User;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Config;
 use Illuminate\Support\Facades\Crypt;
 use Illuminate\Support\Facades\Hash;
 use Illuminate\Support\Once;
@@ -15,6 +17,10 @@
 beforeEach(function () {
     $this->withoutMiddleware([DecideWhatToDoWithUser::class, CheckForcePasswordReset::class]);
     Once::flush();
+    Config::set('app.maintenance.driver', 'file');
+    Config::set('cache.default', 'array');
+    Config::set('session.driver', 'array');
+
     if (! InstanceSettings::find(0)) {
         $settings = new InstanceSettings;
         $settings->id = 0;
@@ -33,7 +39,16 @@
         ]);
         $user->teams()->attach($team->id, ['role' => 'member']);
 
-        $token = Crypt::encryptString("{$user->email}@@@{$password}");
+        $uuid = 'email-verification-test-invitation';
+        $token = Crypt::encryptString("{$user->email}@@@{$uuid}@@@{$password}");
+        TeamInvitation::create([
+            'team_id' => $team->id,
+            'uuid' => $uuid,
+            'email' => $user->email,
+            'role' => 'member',
+            'link' => route('auth.link', ['token' => $token]),
+            'via' => 'link',
+        ]);
 
         $this->get(route('auth.link', ['token' => $token]));
 
@@ -51,9 +66,19 @@
         ]);
         $user->teams()->attach($team->id, ['role' => 'member']);
 
-        $token = Crypt::encryptString("{$user->email}@@@{$password}");
+        $uuid = 'email-verification-login-test-invitation';
+        $token = Crypt::encryptString("{$user->email}@@@{$uuid}@@@{$password}");
+        TeamInvitation::create([
+            'team_id' => $team->id,
+            'uuid' => $uuid,
+            'email' => $user->email,
+            'role' => 'member',
+            'link' => route('auth.link', ['token' => $token]),
+            'via' => 'link',
+        ]);
 
-        $this->get(route('auth.link', ['token' => $token]));
+        $this->get(route('auth.link', ['token' => $token]))
+            ->assertRedirect(route('dashboard'));
 
         expect(auth()->id())->toBe($user->id);
     });
diff --git a/tests/Feature/Livewire/SentinelComponentTest.php b/tests/Feature/Livewire/SentinelComponentTest.php
new file mode 100644
index 000000000..47cad4e22
--- /dev/null
+++ b/tests/Feature/Livewire/SentinelComponentTest.php
@@ -0,0 +1,21 @@
+<?php
+
+it('keeps sentinel restarted events from re-syncing editable form fields', function () {
+    $componentSource = file_get_contents(app_path('Livewire/Server/Sentinel.php'));
+
+    preg_match('/public function handleSentinelRestarted\([^)]*\)\s*\{(?<body>.*?)\n    \}/s', $componentSource, $matches);
+
+    expect($matches['body'] ?? '')
+        ->toContain('$this->sentinelUpdatedAt = $this->server->sentinel_updated_at;')
+        ->not->toContain('$this->syncData();');
+});
+
+it('dispatches a server navbar refresh after toggling sentinel', function () {
+    $componentSource = file_get_contents(app_path('Livewire/Server/Sentinel.php'));
+
+    preg_match('/public function toggleSentinel\([^)]*\).*?\{(?<body>.*?)
+    \}/s', $componentSource, $matches);
+
+    expect($matches['body'] ?? '')
+        ->toContain("\$this->dispatch('refreshServerShow');");
+});
diff --git a/tests/Feature/LogClipboardHandlerTest.php b/tests/Feature/LogClipboardHandlerTest.php
new file mode 100644
index 000000000..1b0273353
--- /dev/null
+++ b/tests/Feature/LogClipboardHandlerTest.php
@@ -0,0 +1,39 @@
+<?php
+
+use Illuminate\Support\Str;
+
+function bladeView(string $path): string
+{
+    return file_get_contents(base_path($path));
+}
+
+it('guards deployment log clipboard writes and reports promise failures', function () {
+    $view = bladeView('resources/views/livewire/project/application/deployment/show.blade.php');
+
+    expect($view)
+        ->toContain('copyLogs()')
+        ->toContain('navigator.clipboard?.writeText')
+        ->toContain("Livewire.dispatch('error', ['Clipboard is not available. Please use HTTPS or localhost.']);")
+        ->toContain("Livewire.dispatch('error', ['Failed to copy logs to clipboard.']);")
+        ->toContain("Livewire.dispatch('success', ['Logs copied to clipboard.']);");
+
+    expect(Str::between($view, 'copyLogs() {', 'downloadLogs()'))
+        ->toContain('navigator.clipboard?.writeText(content).then(() =>')
+        ->not->toContain("navigator.clipboard.writeText(content);\n            Livewire.dispatch('success'");
+});
+
+it('guards shared log clipboard writes and handles Livewire preparation failures', function () {
+    $view = bladeView('resources/views/livewire/project/shared/get-logs.blade.php');
+
+    expect($view)
+        ->toContain('navigator.clipboard?.writeText')
+        ->toContain("Livewire.dispatch('error', ['Clipboard is not available. Please use HTTPS or localhost.']);")
+        ->toContain("Livewire.dispatch('error', ['Failed to copy logs to clipboard.']);")
+        ->toContain("Livewire.dispatch('error', ['Failed to prepare logs for clipboard.']);")
+        ->toContain("Livewire.dispatch('success', ['Logs copied to clipboard.']);");
+
+    expect($view)
+        ->toContain('$wire.copyLogs().then(logs =>')
+        ->toContain('}).catch(() => {')
+        ->not->toContain('navigator.clipboard.writeText(logs);');
+});
diff --git a/tests/Feature/LogDrain/LogDrainNetworkConnectCommandTest.php b/tests/Feature/LogDrain/LogDrainNetworkConnectCommandTest.php
new file mode 100644
index 000000000..ab3144da3
--- /dev/null
+++ b/tests/Feature/LogDrain/LogDrainNetworkConnectCommandTest.php
@@ -0,0 +1,97 @@
+<?php
+
+use App\Actions\Server\StartLogDrain;
+use App\Actions\Service\StartService;
+use App\Models\Environment;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\Service;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+
+uses(RefreshDatabase::class);
+
+function reflectedLogDrainNetworkCommands(object $action, Server|Service $model): array
+{
+    $method = new ReflectionMethod($action, 'logDrainNetworkConnectCommands');
+    $method->setAccessible(true);
+
+    return $method->invoke($action, $model);
+}
+
+function createServerWithTeam(): Server
+{
+    $team = Team::factory()->create();
+
+    return Server::factory()->create(['team_id' => $team->id]);
+}
+
+function createServiceOnServer(Server $server, string $network, bool $connectToDockerNetwork = true): Service
+{
+    $team = Team::factory()->create();
+    $project = Project::factory()->create(['team_id' => $team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+    $destination = StandaloneDocker::query()->firstOrCreate(
+        ['server_id' => $server->id, 'network' => $network],
+        ['uuid' => fake()->uuid(), 'name' => fake()->unique()->word()]
+    );
+
+    return Service::factory()->create([
+        'server_id' => $server->id,
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => StandaloneDocker::class,
+        'connect_to_docker_network' => $connectToDockerNetwork,
+        'docker_compose' => "services:\n  signoz:\n    image: signoz/signoz:latest\n",
+    ]);
+}
+
+it('connects the log drain container to a service preferred network when the server log drain is enabled', function () {
+    $server = createServerWithTeam();
+    $server->settings()->update(['is_logdrain_custom_enabled' => true]);
+    $service = createServiceOnServer($server, 'signoz-net', true);
+
+    $commands = reflectedLogDrainNetworkCommands(new StartService, $service->fresh(['destination.server.settings']));
+
+    expect($commands)->toContain("docker network connect 'signoz-net' coolify-log-drain >/dev/null 2>&1 || true");
+});
+
+it('does not connect the log drain container when service preferred network is disabled', function () {
+    $server = createServerWithTeam();
+    $server->settings()->update(['is_logdrain_custom_enabled' => true]);
+    $service = createServiceOnServer($server, 'signoz-net', false);
+
+    $commands = reflectedLogDrainNetworkCommands(new StartService, $service->fresh(['destination.server.settings']));
+
+    expect($commands)->toBeEmpty();
+});
+
+it('does not connect the log drain container when the server log drain is disabled', function () {
+    $server = createServerWithTeam();
+    $service = createServiceOnServer($server, 'signoz-net', true);
+
+    $commands = reflectedLogDrainNetworkCommands(new StartService, $service->fresh(['destination.server.settings']));
+
+    expect($commands)->toBeEmpty();
+});
+
+it('connects a restarted log drain container to all enabled service preferred networks on the server', function () {
+    $server = createServerWithTeam();
+    $server->settings()->update(['is_logdrain_custom_enabled' => true]);
+    createServiceOnServer($server, 'signoz-net', true);
+    createServiceOnServer($server, 'ignored-net', false);
+    createServiceOnServer($server, 'signoz-net', true);
+
+    $otherServer = createServerWithTeam();
+    createServiceOnServer($otherServer, 'other-server-net', true);
+
+    $commands = reflectedLogDrainNetworkCommands(new StartLogDrain, $server->fresh(['settings']));
+
+    expect($commands)
+        ->toContain("docker network connect 'signoz-net' coolify-log-drain >/dev/null 2>&1 || true")
+        ->not->toContain("docker network connect 'ignored-net' coolify-log-drain >/dev/null 2>&1 || true")
+        ->not->toContain("docker network connect 'other-server-net' coolify-log-drain >/dev/null 2>&1 || true");
+
+    expect($commands)->toHaveCount(1);
+});
diff --git a/tests/Feature/NavigationCloakTest.php b/tests/Feature/NavigationCloakTest.php
new file mode 100644
index 000000000..430400ea7
--- /dev/null
+++ b/tests/Feature/NavigationCloakTest.php
@@ -0,0 +1,16 @@
+<?php
+
+it('strips leftover x-cloak after wire:navigate to prevent blank page', function () {
+    $appJs = file_get_contents(resource_path('js/app.js'));
+
+    expect($appJs)
+        ->toContain("document.addEventListener('livewire:navigated'")
+        ->toContain("querySelectorAll('[x-cloak]')")
+        ->toContain("removeAttribute('x-cloak')");
+});
+
+it('keeps the initial-load x-cloak guard on the app wrapper', function () {
+    $layout = file_get_contents(resource_path('views/layouts/app.blade.php'));
+
+    expect($layout)->toContain('x-cloak');
+});
diff --git a/tests/Feature/OauthControllerTest.php b/tests/Feature/OauthControllerTest.php
index af5fb0658..1388e2980 100644
--- a/tests/Feature/OauthControllerTest.php
+++ b/tests/Feature/OauthControllerTest.php
@@ -30,7 +30,7 @@
         'email' => 'username@example.edu',
     ]);
 
-    $provider = \Mockery::mock();
+    $provider = Mockery::mock();
     $provider->shouldReceive('setConfig')->once()->andReturnSelf();
     $provider->shouldReceive('with')->once()->with(['hd' => 'example.com'])->andReturnSelf();
     $provider->shouldReceive('user')->once()->andReturn((object) [
@@ -58,7 +58,7 @@
         'is_registration_enabled' => true,
     ]);
 
-    $provider = \Mockery::mock();
+    $provider = Mockery::mock();
     $provider->shouldReceive('setConfig')->once()->andReturnSelf();
     $provider->shouldReceive('with')->once()->with(['hd' => 'example.com'])->andReturnSelf();
     $provider->shouldReceive('user')->once()->andReturn((object) [
diff --git a/tests/Feature/PasswordVisibilityComponentTest.php b/tests/Feature/PasswordVisibilityComponentTest.php
index a5087f5cd..9c3d5d673 100644
--- a/tests/Feature/PasswordVisibilityComponentTest.php
+++ b/tests/Feature/PasswordVisibilityComponentTest.php
@@ -21,6 +21,12 @@
         ->not->toContain('changePasswordFieldType');
 });
 
+it('renders password input before visibility toggle in tab order', function () {
+    $html = Blade::render('<x-forms.input type="password" id="secret" />');
+
+    expect(strpos($html, '<input'))->toBeLessThan(strpos($html, 'aria-label="Toggle password visibility"'));
+});
+
 it('renders password textarea with Alpine-managed visibility state', function () {
     $html = Blade::render('<x-forms.textarea type="password" id="secret" />');
 
@@ -31,6 +37,12 @@
         ->not->toContain('changePasswordFieldType');
 });
 
+it('renders password textarea input before visibility toggle in tab order', function () {
+    $html = Blade::render('<x-forms.textarea type="password" id="secret" />');
+
+    expect(strpos($html, '<input'))->toBeLessThan(strpos($html, 'aria-label="Toggle password visibility"'));
+});
+
 it('renders textarea without monospace classes by default', function () {
     $html = Blade::render('<x-forms.textarea id="notes" />');
 
@@ -53,3 +65,9 @@
         ->toContain("x-on:click=\"type = type === 'password' ? 'text' : 'password'\"")
         ->toContain('x-bind:type="type"');
 });
+
+it('renders env var password input before visibility toggle in tab order', function () {
+    $html = Blade::render('<x-forms.env-var-input type="password" id="secret" />');
+
+    expect(strpos($html, '<input'))->toBeLessThan(strpos($html, 'aria-label="Toggle password visibility"'));
+});
diff --git a/tests/Feature/PostgresUpgradeScriptTest.php b/tests/Feature/PostgresUpgradeScriptTest.php
new file mode 100644
index 000000000..bdb6f7c4e
--- /dev/null
+++ b/tests/Feature/PostgresUpgradeScriptTest.php
@@ -0,0 +1,71 @@
+<?php
+
+use Illuminate\Support\Str;
+
+function runPostgresUpgradeScriptCommand(string $script): array
+{
+    $root = base_path();
+    $workingDirectory = sys_get_temp_dir().'/coolify-postgres-upgrade-test-'.Str::random(12);
+    $binDirectory = $workingDirectory.'/bin';
+
+    mkdir($binDirectory, 0777, true);
+
+    file_put_contents($binDirectory.'/docker', <<<'BASH'
+#!/bin/bash
+if [ "$1" = "inspect" ]; then
+    printf '%s\n' "${MOCK_DOCKER_IMAGE}"
+    exit 0
+fi
+
+if [ "$1" = "compose" ]; then
+    printf '%s\n' "${LATEST_IMAGE}" > "${MOCK_LATEST_IMAGE_OUTPUT}"
+    exit 0
+fi
+
+exit 1
+BASH);
+    chmod($binDirectory.'/docker', 0755);
+
+    $outputFile = $workingDirectory.'/latest-image.txt';
+    $command = sprintf(
+        'PATH=%s:$PATH MOCK_LATEST_IMAGE_OUTPUT=%s COOLIFY_POSTGRES_UPGRADE_SOURCE_ONLY=true bash -c %s 2>&1',
+        escapeshellarg($binDirectory),
+        escapeshellarg($outputFile),
+        escapeshellarg('cd '.escapeshellarg($root).'; '.$script),
+    );
+
+    exec($command, $output, $exitCode);
+
+    return [$exitCode, implode("\n", $output), is_file($outputFile) ? trim(file_get_contents($outputFile)) : null];
+}
+
+it('detects the current Coolify image tag from the running container image', function (string $scriptPath, string $image, string $expectedTag) {
+    [$exitCode, $output] = runPostgresUpgradeScriptCommand(sprintf(
+        'MOCK_DOCKER_IMAGE=%s; export MOCK_DOCKER_IMAGE; source %s; current_coolify_image_tag',
+        escapeshellarg($image),
+        escapeshellarg($scriptPath),
+    ));
+
+    expect($exitCode)->toBe(0)
+        ->and($output)->toBe($expectedTag);
+})->with([
+    'nightly standard registry image' => ['other/nightly/upgrade-postgres.sh', 'ghcr.io/coollabsio/coolify:4.0.0-beta.420', '4.0.0-beta.420'],
+    'nightly registry with port' => ['other/nightly/upgrade-postgres.sh', 'registry.example.com:5000/coollabsio/coolify:4.0.1', '4.0.1'],
+    'nightly digest suffix' => ['other/nightly/upgrade-postgres.sh', 'ghcr.io/coollabsio/coolify:4.0.2@sha256:abcdef', '4.0.2'],
+    'scripts standard registry image' => ['scripts/upgrade-postgres.sh', 'ghcr.io/coollabsio/coolify:4.0.0-beta.420', '4.0.0-beta.420'],
+    'scripts registry with port' => ['scripts/upgrade-postgres.sh', 'registry.example.com:5000/coollabsio/coolify:4.0.1', '4.0.1'],
+    'scripts digest suffix' => ['scripts/upgrade-postgres.sh', 'ghcr.io/coollabsio/coolify:4.0.2@sha256:abcdef', '4.0.2'],
+]);
+
+it('passes the preserved Coolify image tag to docker compose when starting the stack', function (string $scriptPath) {
+    [$exitCode, $output, $latestImage] = runPostgresUpgradeScriptCommand(
+        sprintf('source %s; start_stack 4.0.0-beta.420', escapeshellarg($scriptPath)),
+    );
+
+    expect($exitCode)->toBe(0)
+        ->and($output)->toBe('')
+        ->and($latestImage)->toBe('4.0.0-beta.420');
+})->with([
+    'nightly script' => 'other/nightly/upgrade-postgres.sh',
+    'release script' => 'scripts/upgrade-postgres.sh',
+]);
diff --git a/tests/Feature/ScheduleOnOneServerTest.php b/tests/Feature/ScheduleOnOneServerTest.php
index 10758738c..167d16bfa 100644
--- a/tests/Feature/ScheduleOnOneServerTest.php
+++ b/tests/Feature/ScheduleOnOneServerTest.php
@@ -21,6 +21,18 @@
     expect($event->onOneServer)->toBeTrue();
 });
 
+it('schedules ssh mux cleanup locally on every scheduler host', function () {
+    $schedule = app(Schedule::class);
+
+    $event = collect($schedule->events())->first(
+        fn ($e) => (string) $e->description === 'cleanup:ssh-mux'
+    );
+
+    expect($event)->not->toBeNull();
+    expect($event->onOneServer)->toBeFalse();
+    expect($event->getSummaryForDisplay())->toBe('cleanup:ssh-mux');
+});
+
 it('schedules every production job with onOneServer', function () {
     $schedule = app(Schedule::class);
 
diff --git a/tests/Feature/Security/CommandInjectionSecurityTest.php b/tests/Feature/Security/CommandInjectionSecurityTest.php
index b327184a4..5fa5c08d2 100644
--- a/tests/Feature/Security/CommandInjectionSecurityTest.php
+++ b/tests/Feature/Security/CommandInjectionSecurityTest.php
@@ -733,6 +733,7 @@
         '--entrypoint "sh -c \'npm start\'"',
         '--entrypoint "sh -c \'php artisan schedule:work\'"',
         '--hostname "my-host"',
+        '--dns 10.0.0.10 --dns=1.1.1.1',
     ]);
 });
 
diff --git a/tests/Feature/Security/GithubAppSetupCallbackTest.php b/tests/Feature/Security/GithubAppSetupCallbackTest.php
index 9c6893fd1..f56a77d5f 100644
--- a/tests/Feature/Security/GithubAppSetupCallbackTest.php
+++ b/tests/Feature/Security/GithubAppSetupCallbackTest.php
@@ -199,8 +199,9 @@ function fakeGithubInstallationVerificationFailure(): void
 
 it('requires authentication before processing github app install callbacks', function () {
     Http::preventStrayRequests();
+    cacheGithubAppSetupState('valid-install-state', 'install', $this->githubApp);
 
-    $this->get('/webhooks/source/github/install?source='.$this->githubApp->uuid.'&setup_action=install&installation_id=123456')
+    $this->get('/webhooks/source/github/install?state=valid-install-state&setup_action=install&installation_id=123456')
         ->assertRedirect();
 
     Http::assertNothingSent();
@@ -209,22 +210,110 @@ function fakeGithubInstallationVerificationFailure(): void
     expect($this->githubApp->installation_id)->toBeNull();
 });
 
-it('rejects github app install callbacks for an unknown github app', function () {
+it('rejects github app install callbacks with an app uuid as state', function () {
     authenticateGithubSetupCallbackTest($this);
     Http::preventStrayRequests();
 
-    $this->withHeader('Accept', 'application/json')->get('/webhooks/source/github/install?source=does-not-exist&setup_action=install&installation_id=123456')
+    $this->withHeader('Accept', 'application/json')->get('/webhooks/source/github/install?state='.$this->githubApp->uuid.'&setup_action=install&installation_id=123456')
         ->assertNotFound();
 
     Http::assertNothingSent();
 });
 
+it('redirects browser github app install callbacks with missing or expired state to sources', function () {
+    authenticateGithubSetupCallbackTest($this);
+    Http::preventStrayRequests();
+
+    $this->get('/webhooks/source/github/install?setup_action=install&installation_id=123456')
+        ->assertRedirect(route('source.all'));
+
+    $this->get('/webhooks/source/github/install?state=expired-state&setup_action=install&installation_id=123456')
+        ->assertRedirect(route('source.all'));
+
+    Http::assertNothingSent();
+});
+
+it('rejects github app setup states for the wrong callback action', function () {
+    authenticateGithubSetupCallbackTest($this);
+    Http::preventStrayRequests();
+    cacheGithubAppSetupState('manifest-state', 'manifest', $this->githubApp);
+    cacheGithubAppSetupState('install-state', 'install', $this->githubApp);
+
+    $this->withHeader('Accept', 'application/json')->get('/webhooks/source/github/install?state=manifest-state&setup_action=install&installation_id=123456')
+        ->assertNotFound();
+
+    $this->withHeader('Accept', 'application/json')->get('/webhooks/source/github/redirect?state=install-state&code=real-code')
+        ->assertNotFound();
+
+    Http::assertNothingSent();
+});
+
+it('allows github app install callbacks for repository update setup actions', function () {
+    authenticateGithubSetupCallbackTest($this);
+    configureGithubAppCredentials($this->githubApp);
+    $this->githubApp->forceFill(['installation_id' => 111111])->save();
+    Http::preventStrayRequests();
+
+    $this->get('/webhooks/source/github/install?setup_action=update&installation_id=111111')
+        ->assertRedirect(route('source.github.show', ['github_app_uuid' => $this->githubApp->uuid]));
+
+    Http::assertNothingSent();
+
+    $this->githubApp->refresh();
+    expect($this->githubApp->installation_id)->toBe(111111);
+});
+
+it('redirects github app repository update callbacks without a matching source to the sources page', function () {
+    authenticateGithubSetupCallbackTest($this);
+    Http::preventStrayRequests();
+
+    $this->get('/webhooks/source/github/install?setup_action=update&installation_id=123456')
+        ->assertRedirect(route('source.all'));
+
+    Http::assertNothingSent();
+});
+
+it('rejects github app install callbacks for unknown setup actions', function () {
+    authenticateGithubSetupCallbackTest($this);
+    Http::preventStrayRequests();
+    cacheGithubAppSetupState('valid-install-state', 'install', $this->githubApp);
+
+    $this->withHeader('Accept', 'application/json')->get('/webhooks/source/github/install?state=valid-install-state&setup_action=remove&installation_id=123456')
+        ->assertUnprocessable();
+
+    Http::assertNothingSent();
+});
+
+it('rejects github app setup states from another team', function () {
+    authenticateGithubSetupCallbackTest($this);
+    Http::preventStrayRequests();
+
+    $otherTeam = Team::factory()->create();
+    $otherGithubApp = GithubApp::create([
+        'name' => 'Other GitHub App',
+        'api_url' => 'https://api.github.com',
+        'html_url' => 'https://github.com',
+        'custom_user' => 'git',
+        'custom_port' => 22,
+        'team_id' => $otherTeam->id,
+        'is_system_wide' => false,
+    ]);
+
+    cacheGithubAppSetupState('other-team-state', 'manifest', $otherGithubApp);
+
+    $this->withHeader('Accept', 'application/json')->get('/webhooks/source/github/redirect?state=other-team-state&code=real-code')
+        ->assertForbidden();
+
+    Http::assertNothingSent();
+});
+
 it('rejects an installation id that github does not confirm belongs to the app', function () {
     authenticateGithubSetupCallbackTest($this);
     configureGithubAppCredentials($this->githubApp);
     fakeGithubInstallationVerificationFailure();
+    cacheGithubAppSetupState('valid-install-state', 'install', $this->githubApp);
 
-    $this->withHeader('Accept', 'application/json')->get('/webhooks/source/github/install?source='.$this->githubApp->uuid.'&setup_action=install&installation_id=999999')
+    $this->withHeader('Accept', 'application/json')->get('/webhooks/source/github/install?state=valid-install-state&setup_action=install&installation_id=999999')
         ->assertForbidden();
 
     $this->githubApp->refresh();
@@ -235,21 +324,39 @@ function fakeGithubInstallationVerificationFailure(): void
     authenticateGithubSetupCallbackTest($this);
     configureGithubAppCredentials($this->githubApp);
     fakeGithubInstallationVerification($this->githubApp->app_id);
+    cacheGithubAppSetupState('valid-install-state', 'install', $this->githubApp);
 
-    $this->get('/webhooks/source/github/install?source='.$this->githubApp->uuid.'&setup_action=install&installation_id=123456')
+    $this->get('/webhooks/source/github/install?state=valid-install-state&setup_action=install&installation_id=123456')
         ->assertRedirect(route('source.github.show', ['github_app_uuid' => $this->githubApp->uuid]));
 
     $this->githubApp->refresh();
     expect($this->githubApp->installation_id)->toBe(123456);
 });
 
+it('rejects replayed github app install states', function () {
+    authenticateGithubSetupCallbackTest($this);
+    configureGithubAppCredentials($this->githubApp);
+    fakeGithubInstallationVerification($this->githubApp->app_id);
+    cacheGithubAppSetupState('valid-install-state', 'install', $this->githubApp);
+
+    $this->get('/webhooks/source/github/install?state=valid-install-state&setup_action=install&installation_id=123456')
+        ->assertRedirect();
+
+    $this->withHeader('Accept', 'application/json')->get('/webhooks/source/github/install?state=valid-install-state&setup_action=install&installation_id=123456')
+        ->assertNotFound();
+
+    $this->githubApp->refresh();
+    expect($this->githubApp->installation_id)->toBe(123456);
+});
+
 it('allows reinstalling an already configured github app installation id', function () {
     authenticateGithubSetupCallbackTest($this);
     configureGithubAppCredentials($this->githubApp);
     $this->githubApp->forceFill(['installation_id' => 111111])->save();
     fakeGithubInstallationVerification($this->githubApp->app_id);
+    cacheGithubAppSetupState('valid-install-state', 'install', $this->githubApp);
 
-    $this->get('/webhooks/source/github/install?source='.$this->githubApp->uuid.'&setup_action=install&installation_id=222222')
+    $this->get('/webhooks/source/github/install?state=valid-install-state&setup_action=install&installation_id=222222')
         ->assertRedirect(route('source.github.show', ['github_app_uuid' => $this->githubApp->uuid]));
 
     $this->githubApp->refresh();
diff --git a/tests/Feature/ServerUpdatePrivateKeyApiTest.php b/tests/Feature/ServerUpdatePrivateKeyApiTest.php
new file mode 100644
index 000000000..8bc5f1d0e
--- /dev/null
+++ b/tests/Feature/ServerUpdatePrivateKeyApiTest.php
@@ -0,0 +1,130 @@
+<?php
+
+use App\Models\InstanceSettings;
+use App\Models\PrivateKey;
+use App\Models\Server;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Testing\TestResponse;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    config()->set('app.maintenance.driver', 'file');
+    config()->set('cache.default', 'array');
+
+    InstanceSettings::forceCreate(['id' => 0, 'is_api_enabled' => true]);
+
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+    session(['currentTeam' => $this->team]);
+
+    $this->oldPrivateKey = createServerUpdatePrivateKeyApiKey($this->team, 'Old Key');
+    $this->newPrivateKey = createServerUpdatePrivateKeyApiKey($this->team, 'New Key');
+
+    $this->server = Server::factory()->create([
+        'team_id' => $this->team->id,
+        'private_key_id' => $this->oldPrivateKey->id,
+    ]);
+
+    $token = $this->user->createToken('write-token', ['write']);
+    $token->accessToken->forceFill(['team_id' => $this->team->id])->save();
+    $this->bearerToken = $token->plainTextToken;
+});
+
+function createServerUpdatePrivateKeyApiKey(Team $team, string $name): PrivateKey
+{
+    return PrivateKey::create([
+        'name' => $name,
+        'private_key' => generateSSHKey('ed25519')['private'],
+        'team_id' => $team->id,
+    ]);
+}
+
+function patchServerUpdatePrivateKeyApi(object $test, Server $server, string $bearerToken, array $payload): TestResponse
+{
+    return $test->withHeaders([
+        'Authorization' => 'Bearer '.$bearerToken,
+        'Content-Type' => 'application/json',
+    ])->patchJson('/api/v1/servers/'.$server->uuid, $payload);
+}
+
+it('updates the server private key from private_key_uuid', function () {
+    patchServerUpdatePrivateKeyApi($this, $this->server, $this->bearerToken, [
+        'private_key_uuid' => $this->newPrivateKey->uuid,
+    ])->assertCreated()
+        ->assertJson(['uuid' => $this->server->uuid]);
+
+    expect($this->server->fresh()->private_key_id)->toBe($this->newPrivateKey->id);
+});
+
+it('returns not found for an unknown private_key_uuid and leaves the key unchanged', function () {
+    patchServerUpdatePrivateKeyApi($this, $this->server, $this->bearerToken, [
+        'private_key_uuid' => 'unknown-private-key-uuid',
+    ])->assertNotFound()
+        ->assertJson(['message' => 'Private key not found.']);
+
+    expect($this->server->fresh()->private_key_id)->toBe($this->oldPrivateKey->id);
+});
+
+it('does not allow attaching a private key from another team', function () {
+    $otherTeam = Team::factory()->create();
+    $otherTeamPrivateKey = createServerUpdatePrivateKeyApiKey($otherTeam, 'Other Team Key');
+
+    patchServerUpdatePrivateKeyApi($this, $this->server, $this->bearerToken, [
+        'private_key_uuid' => $otherTeamPrivateKey->uuid,
+    ])->assertNotFound()
+        ->assertJson(['message' => 'Private key not found.']);
+
+    expect($this->server->fresh()->private_key_id)->toBe($this->oldPrivateKey->id);
+});
+
+it('keeps the existing private key when private_key_uuid is omitted', function () {
+    patchServerUpdatePrivateKeyApi($this, $this->server, $this->bearerToken, [
+        'name' => 'Renamed Server',
+    ])->assertCreated()
+        ->assertJson(['uuid' => $this->server->uuid]);
+
+    $server = $this->server->fresh();
+
+    expect($server->name)->toBe('Renamed Server')
+        ->and($server->private_key_id)->toBe($this->oldPrivateKey->id);
+});
+
+it('can disable build server mode via API', function () {
+    $this->server->settings()->update(['is_build_server' => true]);
+
+    patchServerUpdatePrivateKeyApi($this, $this->server, $this->bearerToken, [
+        'is_build_server' => false,
+    ])->assertCreated()
+        ->assertJson(['uuid' => $this->server->uuid]);
+
+    expect($this->server->settings->fresh()->is_build_server)->toBeFalse();
+});
+
+it('rejects an invalid disk usage check frequency without partially updating the server', function () {
+    $this->server->proxy->set('type', 'TRAEFIK');
+    $this->server->save();
+    $this->server->settings()->update(['is_build_server' => false]);
+
+    patchServerUpdatePrivateKeyApi($this, $this->server, $this->bearerToken, [
+        'name' => 'Renamed Server',
+        'is_build_server' => true,
+        'proxy_type' => 'none',
+        'server_disk_usage_check_frequency' => 'not a valid schedule',
+    ])->assertUnprocessable()
+        ->assertJson([
+            'message' => 'Validation failed.',
+            'errors' => [
+                'server_disk_usage_check_frequency' => ['Invalid Cron / Human expression for Disk Usage Check Frequency.'],
+            ],
+        ]);
+
+    $server = $this->server->fresh();
+
+    expect($server->name)->not->toBe('Renamed Server')
+        ->and($server->settings->is_build_server)->toBeFalse()
+        ->and($server->proxy->get('type'))->toBe('TRAEFIK');
+});
diff --git a/tests/Feature/ServerUsernameValidationTest.php b/tests/Feature/ServerUsernameValidationTest.php
new file mode 100644
index 000000000..4213ee21d
--- /dev/null
+++ b/tests/Feature/ServerUsernameValidationTest.php
@@ -0,0 +1,182 @@
+<?php
+
+use App\Livewire\Boarding\Index as BoardingIndex;
+use App\Livewire\Server\New\ByIp;
+use App\Models\InstanceSettings;
+use App\Models\PrivateKey;
+use App\Models\Server;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Livewire\Livewire;
+use Visus\Cuid2\Cuid2;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    config(['app.maintenance.driver' => 'file']);
+
+    InstanceSettings::forceCreate(['id' => 0, 'is_api_enabled' => true]);
+
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+
+    session(['currentTeam' => $this->team]);
+
+    $this->privateKey = PrivateKey::withoutEvents(fn () => PrivateKey::forceCreate([
+        'uuid' => (string) new Cuid2,
+        'name' => 'Test SSH Key',
+        'description' => 'Test SSH Key',
+        'private_key' => 'test-private-key',
+        'team_id' => $this->team->id,
+    ]));
+
+    $token = $this->user->createToken('write-token', ['write']);
+    $token->accessToken->forceFill(['team_id' => $this->team->id])->save();
+    $this->token = $token->plainTextToken;
+});
+
+it('creates a server through the API with a dotted SSH username', function () {
+    $response = $this->withHeaders([
+        'Authorization' => 'Bearer '.$this->token,
+        'Content-Type' => 'application/json',
+    ])->postJson('/api/v1/servers', [
+        'name' => 'Dotted User Server',
+        'ip' => '192.0.2.10',
+        'private_key_uuid' => $this->privateKey->uuid,
+        'user' => 'deploy.user',
+    ]);
+
+    $response->assertCreated();
+    $this->assertDatabaseHas('servers', [
+        'ip' => '192.0.2.10',
+        'user' => 'deploy.user',
+    ]);
+});
+
+it('updates a server through the API with a dotted SSH username', function () {
+    $server = Server::factory()->create([
+        'team_id' => $this->team->id,
+        'private_key_id' => $this->privateKey->id,
+        'user' => 'deploy',
+    ]);
+
+    $response = $this->withHeaders([
+        'Authorization' => 'Bearer '.$this->token,
+        'Content-Type' => 'application/json',
+    ])->patchJson('/api/v1/servers/'.$server->uuid, [
+        'user' => 'deploy.user',
+    ]);
+
+    $response->assertStatus(201);
+    expect($server->fresh()->user)->toBe('deploy.user');
+});
+
+it('rejects unsafe SSH usernames when creating a server through the API', function () {
+    $response = $this->withHeaders([
+        'Authorization' => 'Bearer '.$this->token,
+        'Content-Type' => 'application/json',
+    ])->postJson('/api/v1/servers', [
+        'name' => 'Unsafe User Server',
+        'ip' => '192.0.2.11',
+        'private_key_uuid' => $this->privateKey->uuid,
+        'user' => 'deploy$user',
+    ]);
+
+    $response->assertStatus(422);
+    $response->assertJsonPath('errors.user.0', 'The User may only contain letters, numbers, dots, hyphens, and underscores.');
+});
+
+it('rejects unsafe SSH usernames through the API', function () {
+    $server = Server::factory()->create([
+        'team_id' => $this->team->id,
+        'private_key_id' => $this->privateKey->id,
+    ]);
+
+    $response = $this->withHeaders([
+        'Authorization' => 'Bearer '.$this->token,
+        'Content-Type' => 'application/json',
+    ])->patchJson('/api/v1/servers/'.$server->uuid, [
+        'user' => 'deploy$user',
+    ]);
+
+    $response->assertStatus(422);
+    $response->assertJsonStructure(['errors' => ['user']]);
+    $response->assertJsonPath('errors.user.0', 'The User may only contain letters, numbers, dots, hyphens, and underscores.');
+});
+
+it('allows dotted SSH usernames in the server creation form', function () {
+    $this->actingAs($this->user);
+
+    Livewire::test(ByIp::class, [
+        'private_keys' => collect([$this->privateKey]),
+        'limit_reached' => false,
+    ])
+        ->set('name', 'Dotted User Server')
+        ->set('ip', '192.0.2.20')
+        ->set('user', 'deploy.user')
+        ->set('private_key_id', $this->privateKey->id)
+        ->call('submit')
+        ->assertHasNoErrors(['user']);
+
+    $this->assertDatabaseHas('servers', [
+        'ip' => '192.0.2.20',
+        'user' => 'deploy.user',
+    ]);
+});
+
+it('rejects unsafe SSH usernames in the server creation form', function () {
+    $this->actingAs($this->user);
+
+    Livewire::test(ByIp::class, [
+        'private_keys' => collect([$this->privateKey]),
+        'limit_reached' => false,
+    ])
+        ->set('name', 'Unsafe User Server')
+        ->set('ip', '192.0.2.21')
+        ->set('user', 'deploy$user')
+        ->set('private_key_id', $this->privateKey->id)
+        ->call('submit')
+        ->assertHasErrors(['user' => ['regex']]);
+});
+
+it('rejects unsafe SSH usernames during onboarding server creation', function () {
+    $this->actingAs($this->user);
+
+    Livewire::test(BoardingIndex::class)
+        ->set('createdPrivateKey', $this->privateKey)
+        ->set('remoteServerName', 'Unsafe User Server')
+        ->set('remoteServerHost', '192.0.2.30')
+        ->set('remoteServerPort', 22)
+        ->set('remoteServerUser', 'deploy$user')
+        ->call('saveServer')
+        ->assertHasErrors([
+            'remoteServerUser' => [
+                'regex',
+                'The SSH User may only contain letters, numbers, dots, hyphens, and underscores.',
+            ],
+        ]);
+});
+
+it('rejects unsafe SSH usernames during onboarding server validation', function () {
+    $this->actingAs($this->user);
+
+    $server = Server::factory()->create([
+        'team_id' => $this->team->id,
+        'private_key_id' => $this->privateKey->id,
+        'user' => 'deploy',
+    ]);
+
+    Livewire::test(BoardingIndex::class)
+        ->set('createdServer', $server)
+        ->set('remoteServerPort', 22)
+        ->set('remoteServerUser', 'deploy$user')
+        ->call('saveAndValidateServer')
+        ->assertHasErrors([
+            'remoteServerUser' => [
+                'regex',
+                'The SSH User may only contain letters, numbers, dots, hyphens, and underscores.',
+            ],
+        ]);
+});
diff --git a/tests/Feature/ServiceTemplatesLastUpdatedHintTest.php b/tests/Feature/ServiceTemplatesLastUpdatedHintTest.php
new file mode 100644
index 000000000..99b9f7ad7
--- /dev/null
+++ b/tests/Feature/ServiceTemplatesLastUpdatedHintTest.php
@@ -0,0 +1,70 @@
+<?php
+
+use App\Livewire\Project\New\Select;
+use Carbon\CarbonImmutable;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\View;
+use Illuminate\Support\ViewErrorBag;
+
+beforeEach(function () {
+    Cache::flush();
+});
+
+it('returns the service templates bundle last updated timestamp', function () {
+    $component = new Select;
+    $templatePath = base_path('templates/'.config('constants.services.file_name'));
+
+    $resources = $component->loadServices();
+
+    expect($resources)
+        ->toHaveKey('serviceTemplatesLastUpdated')
+        ->and($resources['serviceTemplatesLastUpdated'])
+        ->toBe(CarbonImmutable::createFromTimestamp(filemtime($templatePath))->timezone(config('app.timezone'))->format('M j, Y H:i'));
+});
+
+it('returns each service template last updated timestamp', function () {
+    $component = new Select;
+    $templatePath = base_path('templates/compose/activepieces.yaml');
+
+    $resources = $component->loadServices();
+
+    expect($resources['services']['activepieces'])
+        ->toHaveKey('templateLastUpdated')
+        ->and($resources['services']['activepieces']['templateLastUpdated'])
+        ->toBe(CarbonImmutable::createFromTimestamp(filemtime($templatePath))->timezone(config('app.timezone'))->format('M j, Y H:i'));
+});
+
+it('uses a service template timestamp cache keyed by bundle mtime', function () {
+    $bundleMtime = filemtime(base_path('templates/'.config('constants.services.file_name')));
+    Cache::put("service-template-last-updated-map:{$bundleMtime}", [
+        'activepieces' => 'Cached timestamp',
+    ], now()->addDay());
+
+    $resources = (new Select)->loadServices();
+
+    expect($resources['services']['activepieces']['templateLastUpdated'])->toBe('Cached timestamp');
+});
+
+it('does not use stale service template timestamp cache entries from another bundle mtime', function () {
+    $bundleMtime = filemtime(base_path('templates/'.config('constants.services.file_name')));
+    Cache::put('service-template-last-updated-map:'.($bundleMtime - 1), [
+        'activepieces' => 'Stale cached timestamp',
+    ], now()->addDay());
+
+    $resources = (new Select)->loadServices();
+
+    expect($resources['services']['activepieces']['templateLastUpdated'])->not->toBe('Stale cached timestamp');
+});
+
+it('renders the service templates last updated hint placeholder', function () {
+    View::share('errors', new ViewErrorBag);
+
+    $view = $this->view('livewire.project.new.select', [
+        'current_step' => 'type',
+        'environments' => collect(),
+    ]);
+
+    $view->assertSee('Last Updated on Service Templates:');
+    $view->assertSee('serviceTemplatesLastUpdated');
+    $view->assertSee('service.templateLastUpdated');
+});
diff --git a/tests/Feature/SshMultiplexingLockTest.php b/tests/Feature/SshMultiplexingLockTest.php
index b914765f6..f06e50c1a 100644
--- a/tests/Feature/SshMultiplexingLockTest.php
+++ b/tests/Feature/SshMultiplexingLockTest.php
@@ -1,17 +1,19 @@
 <?php
 
 use App\Helpers\SshMultiplexingHelper;
+use App\Jobs\CleanupStaleMultiplexedConnections;
 use App\Models\PrivateKey;
 use App\Models\Server;
 use App\Models\User;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\File;
 use Illuminate\Support\Facades\Process;
 use Illuminate\Support\Facades\Storage;
 
 /**
- * SSH multiplexing now relies on OpenSSH's native lazy ControlMaster handling.
- * Coolify should add mux options to real ssh/scp commands, but must not pre-warm
- * background masters with separate `ssh -fN` processes.
+ * Tests for the explicit per-server mux lock that prevents concurrent workers
+ * from racing on initial ControlMaster creation.
  */
 uses(RefreshDatabase::class);
 
@@ -20,12 +22,18 @@ function makeMuxServer(): Server
     $user = User::factory()->create();
     $team = $user->teams()->first();
 
-    $privateKeyContent = "-----BEGIN OPENSSH PRIVATE KEY-----\n".
-        "b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW\n".
-        "QyNTUxOQAAACBbhpqHhqv6aI67Mj9abM3DVbmcfYhZAhC7ca4d9UCevAAAAJi/QySHv0Mk\n".
-        "hwAAAAtzc2gtZWQyNTUxOQAAACBbhpqHhqv6aI67Mj9abM3DVbmcfYhZAhC7ca4d9UCevA\n".
-        "AAAECBQw4jg1WRT2IGHMncCiZhURCts2s24HoDS0thHnnRKVuGmoeGq/pojrsyP1pszcNV\n".
-        "uZx9iFkCELtxrh31QJ68AAAAEXNhaWxANzZmZjY2ZDJlMmRkAQIDBA==\n".
+    $privateKeyContent = '-----BEGIN OPENSSH PRIVATE KEY-----
+'.
+        'b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
+'.
+        'QyNTUxOQAAACBbhpqHhqv6aI67Mj9abM3DVbmcfYhZAhC7ca4d9UCevAAAAJi/QySHv0Mk
+'.
+        'hwAAAAtzc2gtZWQyNTUxOQAAACBbhpqHhqv6aI67Mj9abM3DVbmcfYhZAhC7ca4d9UCevA
+'.
+        'AAAECBQw4jg1WRT2IGHMncCiZhURCts2s24HoDS0thHnnRKVuGmoeGq/pojrsyP1pszcNV
+'.
+        'uZx9iFkCELtxrh31QJ68AAAAEXNhaWxANzZmZjY2ZDJlMmRkAQIDBA==
+'.
         '-----END OPENSSH PRIVATE KEY-----';
 
     $privateKey = PrivateKey::create([
@@ -37,87 +45,92 @@ function makeMuxServer(): Server
     Storage::fake('ssh-keys');
     Storage::disk('ssh-keys')->put("ssh_key@{$privateKey->uuid}", $privateKeyContent);
 
-    return Server::factory()->create([
+    $server = Server::factory()->create([
         'team_id' => $team->id,
         'private_key_id' => $privateKey->id,
     ]);
+
+    Storage::disk('ssh-keys')->put("ssh_key@{$server->privateKey->uuid}", $server->privateKey->private_key);
+
+    return $server;
 }
 
-it('does not prewarm a background ssh master', function () {
+it('establishes a master with ssh -fN and never the orphan-prone ssh -fNM', function () {
     config(['constants.ssh.mux_enabled' => true]);
     $server = makeMuxServer();
 
-    Process::fake();
+    Process::fake([
+        '*-O check*' => Process::result(exitCode: 1),
+        '*-fN *' => Process::result(exitCode: 0),
+    ]);
 
     expect(SshMultiplexingHelper::ensureMultiplexedConnection($server))->toBeTrue();
 
-    Process::assertNothingRan();
+    Process::assertRan(fn ($process) => str_contains($process->command, 'ssh -fN ')
+        && ! str_contains($process->command, 'ssh -fNM'));
 });
 
-it('adds native openssh multiplexing options to ssh commands', function () {
-    config(['constants.ssh.mux_enabled' => true]);
-    $server = makeMuxServer();
-    Storage::disk('ssh-keys')->put("ssh_key@{$server->privateKey->uuid}", $server->privateKey->private_key);
-
-    Process::fake();
-
-    $command = SshMultiplexingHelper::generateSshCommand($server, 'echo ok');
-
-    expect($command)
-        ->toContain('-o ControlMaster=auto')
-        ->toContain("-o ControlPath=/var/www/html/storage/app/ssh/mux/mux_{$server->uuid}")
-        ->toContain('-o ControlPersist=3600')
-        ->not->toContain('-O check')
-        ->not->toContain('ssh -fN');
-
-    Process::assertNothingRan();
-});
-
-it('can generate terminal ssh commands without a hard command timeout', function () {
-    config(['constants.ssh.mux_enabled' => true]);
-    $server = makeMuxServer();
-    Storage::disk('ssh-keys')->put("ssh_key@{$server->privateKey->uuid}", $server->privateKey->private_key);
-
-    $command = SshMultiplexingHelper::generateSshCommand($server, 'echo ok', commandTimeout: 0);
-
-    expect($command)
-        ->toStartWith('ssh ')
-        ->not->toStartWith('timeout ')
-        ->not->toContain('timeout 3600 ssh');
-});
-
-it('omits native multiplexing options when ssh multiplexing is disabled for a command', function () {
-    config(['constants.ssh.mux_enabled' => true]);
-    $server = makeMuxServer();
-    Storage::disk('ssh-keys')->put("ssh_key@{$server->privateKey->uuid}", $server->privateKey->private_key);
-
-    $command = SshMultiplexingHelper::generateSshCommand($server, 'echo ok', disableMultiplexing: true);
-
-    expect($command)
-        ->not->toContain('-o ControlMaster=auto')
-        ->not->toContain('-o ControlPath=')
-        ->not->toContain('-o ControlPersist=');
-});
-
-it('adds native openssh multiplexing options to scp commands', function () {
-    config(['constants.ssh.mux_enabled' => true]);
+it('reuses an existing healthy master without spawning a new one', function () {
+    config([
+        'constants.ssh.mux_enabled' => true,
+        'constants.ssh.mux_health_check_enabled' => true,
+    ]);
     $server = makeMuxServer();
 
-    Process::fake();
+    Process::fake([
+        '*-O check*' => Process::result(exitCode: 0),
+        '*health_check_ok*' => Process::result(output: 'health_check_ok', exitCode: 0),
+    ]);
 
-    $command = SshMultiplexingHelper::generateScpCommand($server, '/tmp/source', '/tmp/dest');
+    expect(SshMultiplexingHelper::ensureMultiplexedConnection($server))->toBeTrue();
 
-    expect($command)
-        ->toContain('-o ControlMaster=auto')
-        ->toContain("-o ControlPath=/var/www/html/storage/app/ssh/mux/mux_{$server->uuid}")
-        ->toContain('-o ControlPersist=3600')
-        ->not->toContain('-O check')
-        ->not->toContain('ssh -fN');
-
-    Process::assertNothingRan();
+    Process::assertNotRan(fn ($process) => str_contains($process->command, 'ssh -fN'));
 });
 
-it('returns false and runs no process when multiplexing is globally disabled', function () {
+it('refreshes an expired master before reuse', function () {
+    config([
+        'constants.ssh.mux_enabled' => true,
+        'constants.ssh.mux_health_check_enabled' => false,
+        'constants.ssh.mux_max_age' => 10,
+    ]);
+    $server = makeMuxServer();
+    Cache::put("ssh_mux_connection_time_{$server->uuid}", time() - 30, 3600);
+
+    Process::fake([
+        '*-O check*' => Process::result(exitCode: 0),
+        '*-O exit*' => Process::result(exitCode: 0),
+        '*-fN *' => Process::result(exitCode: 0),
+    ]);
+
+    expect(SshMultiplexingHelper::ensureMultiplexedConnection($server))->toBeTrue();
+
+    Process::assertRan(fn ($process) => str_contains($process->command, 'ssh -O exit'));
+    Process::assertRan(fn ($process) => str_contains($process->command, 'ssh -fN '));
+});
+
+it('does not spawn a master when the per-server lock is already held', function () {
+    config([
+        'constants.ssh.mux_enabled' => true,
+        'constants.ssh.mux_lock_timeout' => 0,
+    ]);
+    $server = makeMuxServer();
+
+    Process::fake([
+        '*-O check*' => Process::result(exitCode: 1),
+    ]);
+
+    $lockKey = 'ssh_mux_lock_'.(gethostname() ?: 'unknown').'_'.$server->uuid;
+    $held = Cache::lock($lockKey, 30);
+    expect($held->get())->toBeTrue();
+
+    expect(SshMultiplexingHelper::ensureMultiplexedConnection($server))->toBeFalse();
+
+    Process::assertNotRan(fn ($process) => str_contains($process->command, 'ssh -fN '));
+
+    $held->release();
+});
+
+it('returns false and runs no ssh when multiplexing is disabled', function () {
     config(['constants.ssh.mux_enabled' => false]);
     $server = makeMuxServer();
 
@@ -127,3 +140,182 @@ function makeMuxServer(): Server
 
     Process::assertNothingRan();
 });
+
+it('adds mux options to ssh commands only after the explicit master is ready', function () {
+    config(['constants.ssh.mux_enabled' => true]);
+    $server = makeMuxServer();
+
+    Process::fake([
+        '*-O check*' => Process::result(exitCode: 1),
+        '*-fN *' => Process::result(exitCode: 0),
+    ]);
+
+    $command = SshMultiplexingHelper::generateSshCommand($server, 'echo ok');
+
+    expect($command)
+        ->toContain('-o ControlMaster=auto')
+        ->toContain("-o ControlPath=/var/www/html/storage/app/ssh/mux/mux_{$server->uuid}")
+        ->toContain('-o ControlPersist=3600')
+        ->toContain("'bash -se' << \\")
+        ->not->toContain('<< $delimiter');
+
+    Process::assertRan(fn ($process) => str_contains($process->command, 'ssh -fN '));
+});
+
+it('can generate terminal ssh commands without a hard command timeout', function () {
+    config(['constants.ssh.mux_enabled' => false]);
+    $server = makeMuxServer();
+
+    $command = SshMultiplexingHelper::generateSshCommand($server, 'echo ok', commandTimeout: 0);
+
+    expect($command)
+        ->toStartWith('ssh ')
+        ->not->toStartWith('timeout ')
+        ->not->toContain('timeout 3600 ssh');
+});
+
+it('omits multiplexing options and setup when disabled for a command', function () {
+    config(['constants.ssh.mux_enabled' => true]);
+    $server = makeMuxServer();
+
+    Process::fake();
+
+    $command = SshMultiplexingHelper::generateSshCommand($server, 'echo ok', disableMultiplexing: true);
+
+    expect($command)
+        ->not->toContain('-o ControlMaster=auto')
+        ->not->toContain('-o ControlPath=')
+        ->not->toContain('-o ControlPersist=');
+
+    Process::assertNothingRan();
+});
+
+it('adds mux options to scp commands only after the explicit master is ready', function () {
+    config(['constants.ssh.mux_enabled' => true]);
+    $server = makeMuxServer();
+
+    Process::fake([
+        '*-O check*' => Process::result(exitCode: 1),
+        '*-fN *' => Process::result(exitCode: 0),
+    ]);
+
+    $command = SshMultiplexingHelper::generateScpCommand($server, '/tmp/source', '/tmp/dest');
+
+    expect($command)
+        ->toContain('-o ControlMaster=auto')
+        ->toContain("-o ControlPath=/var/www/html/storage/app/ssh/mux/mux_{$server->uuid}")
+        ->toContain('-o ControlPersist=3600');
+
+    Process::assertRan(fn ($process) => str_contains($process->command, 'ssh -fN '));
+});
+
+it('kills only old orphaned ssh masters whose control socket no longer exists', function () {
+    config(['constants.ssh.mux_orphan_reap_enabled' => true]);
+    $muxDir = storage_path('app/ssh/mux');
+    File::ensureDirectoryExists($muxDir);
+
+    $liveSocket = $muxDir.'/mux_live_'.uniqid();
+    $orphanSocket = $muxDir.'/mux_orphan_'.uniqid();
+    $youngSocket = $muxDir.'/mux_young_'.uniqid();
+    File::put($liveSocket, 'x');
+
+    Process::fake([
+        'ps*' => Process::result(output: "111 1 5000 ssh -fN -o ControlMaster=auto -o ControlPath={$liveSocket} root@1.2.3.4
+".
+            "222 1 5000 ssh -fN -o ControlMaster=auto -o ControlPath={$orphanSocket} root@1.2.3.4
+".
+            "333 1 30 ssh -fN -o ControlMaster=auto -o ControlPath={$youngSocket} root@1.2.3.4
+"),
+        'kill*' => Process::result(exitCode: 0),
+    ]);
+
+    $job = new CleanupStaleMultiplexedConnections;
+    $method = new ReflectionMethod($job, 'cleanupOrphanedSshProcesses');
+    $method->setAccessible(true);
+    $method->invoke($job);
+
+    Process::assertRan(fn ($process) => str_contains($process->command, 'kill') && str_contains($process->command, '222'));
+    Process::assertNotRan(fn ($process) => str_contains($process->command, 'kill') && str_contains($process->command, '111'));
+    Process::assertNotRan(fn ($process) => str_contains($process->command, 'kill') && str_contains($process->command, '333'));
+
+    File::delete($liveSocket);
+});
+
+it('kills only old orphaned cloudflared proxies whose parent ssh is gone', function () {
+    config(['constants.ssh.mux_orphan_reap_enabled' => true]);
+
+    Process::fake([
+        'ps*' => Process::result(output: '100 1 5000 ssh -fN -o ControlMaster=auto root@1.2.3.4
+'.
+            '200 100 5000 cloudflared access ssh --hostname host.example.com
+'.
+            '300 2176 5000 cloudflared access ssh --hostname host.example.com
+'.
+            '400 2176 30 cloudflared access ssh --hostname host.example.com
+'.
+            '2176 1 9000 /usr/bin/some-supervisor
+'),
+        'kill*' => Process::result(exitCode: 0),
+    ]);
+
+    $job = new CleanupStaleMultiplexedConnections;
+    $method = new ReflectionMethod($job, 'cleanupOrphanedCloudflaredProcesses');
+    $method->setAccessible(true);
+    $method->invoke($job);
+
+    Process::assertRan(fn ($process) => str_contains($process->command, 'kill') && str_contains($process->command, '300'));
+    Process::assertNotRan(fn ($process) => str_contains($process->command, 'kill') && str_contains($process->command, '200'));
+    Process::assertNotRan(fn ($process) => str_contains($process->command, 'kill') && str_contains($process->command, '400'));
+});
+
+it('dry-run mode logs orphans but kills nothing when reaping is disabled', function () {
+    config(['constants.ssh.mux_orphan_reap_enabled' => false]);
+    $muxDir = storage_path('app/ssh/mux');
+    File::ensureDirectoryExists($muxDir);
+
+    $orphanSocket = $muxDir.'/mux_orphan_'.uniqid();
+
+    Process::fake([
+        'ps*' => Process::result(output: "222 1 5000 ssh -fN -o ControlMaster=auto -o ControlPath={$orphanSocket} root@1.2.3.4
+"),
+        'kill*' => Process::result(exitCode: 0),
+    ]);
+
+    $job = new CleanupStaleMultiplexedConnections;
+    $method = new ReflectionMethod($job, 'cleanupOrphanedSshProcesses');
+    $method->setAccessible(true);
+    $method->invoke($job);
+
+    Process::assertNotRan(fn ($process) => str_contains($process->command, 'kill'));
+});
+
+it('removes mux files for non-existent servers when reaping is enabled', function () {
+    config(['constants.ssh.mux_orphan_reap_enabled' => true]);
+    Storage::fake('ssh-mux');
+    $file = 'mux_ghost'.uniqid();
+    Storage::disk('ssh-mux')->put($file, 'x');
+    Process::fake();
+
+    $job = new CleanupStaleMultiplexedConnections;
+    $method = new ReflectionMethod($job, 'cleanupNonExistentServerConnections');
+    $method->setAccessible(true);
+    $method->invoke($job);
+
+    expect(Storage::disk('ssh-mux')->exists($file))->toBeFalse();
+});
+
+it('keeps mux files for non-existent servers in dry-run mode', function () {
+    config(['constants.ssh.mux_orphan_reap_enabled' => false]);
+    Storage::fake('ssh-mux');
+    $file = 'mux_ghost'.uniqid();
+    Storage::disk('ssh-mux')->put($file, 'x');
+    Process::fake();
+
+    $job = new CleanupStaleMultiplexedConnections;
+    $method = new ReflectionMethod($job, 'cleanupNonExistentServerConnections');
+    $method->setAccessible(true);
+    $method->invoke($job);
+
+    expect(Storage::disk('ssh-mux')->exists($file))->toBeTrue();
+    Process::assertNothingRan();
+});
diff --git a/tests/Feature/SyncBunnyTest.php b/tests/Feature/SyncBunnyTest.php
index 841bb5b5f..ca3091841 100644
--- a/tests/Feature/SyncBunnyTest.php
+++ b/tests/Feature/SyncBunnyTest.php
@@ -46,3 +46,22 @@ function createSyncBunnyFailingBinary(string $binDir, string $name): void
     Http::assertSent(fn ($request) => str_starts_with($request->url(), 'https://api.bunny.net/purge')
         && $request['url'] === 'https://cdn.coollabs.io/coolify-nightly/versions.json');
 });
+
+it('syncs postgres upgrade script to BunnyCDN during full sync', function () {
+    Http::fake([
+        'https://cdn.coollabs.io/coolify/*' => Http::response('', 404),
+        'https://storage.bunnycdn.com/*' => Http::response([], 201),
+        'https://api.bunny.net/purge*' => Http::response([], 200),
+    ]);
+
+    $this->artisan('sync:bunny')
+        ->expectsConfirmation('Are you sure you want to sync?', 'yes')
+        ->expectsOutputToContain('BunnyCDN sync: Complete')
+        ->assertExitCode(0);
+
+    Http::assertSent(fn ($request) => $request->method() === 'PUT'
+        && $request->url() === 'https://storage.bunnycdn.com/coolcdn/coolify/upgrade-postgres.sh');
+
+    Http::assertSent(fn ($request) => str_starts_with($request->url(), 'https://api.bunny.net/purge')
+        && $request['url'] === 'https://cdn.coollabs.io/coolify/upgrade-postgres.sh');
+});
diff --git a/tests/Feature/Team/ScheduledJobMonitoringTest.php b/tests/Feature/Team/ScheduledJobMonitoringTest.php
index 036c3b638..6801151fb 100644
--- a/tests/Feature/Team/ScheduledJobMonitoringTest.php
+++ b/tests/Feature/Team/ScheduledJobMonitoringTest.php
@@ -2,9 +2,15 @@
 
 use App\Livewire\Settings\ScheduledJobs;
 use App\Models\DockerCleanupExecution;
+use App\Models\Environment;
+use App\Models\Project;
 use App\Models\ScheduledDatabaseBackup;
 use App\Models\ScheduledDatabaseBackupExecution;
 use App\Models\Server;
+use App\Models\Service;
+use App\Models\ServiceDatabase;
+use App\Models\StandaloneDocker;
+use App\Models\StandalonePostgresql;
 use App\Models\Team;
 use App\Models\User;
 use App\Services\SchedulerLogParser;
@@ -13,6 +19,35 @@
 
 uses(RefreshDatabase::class);
 
+function withIsolatedScheduledLogsForMonitoringTest(callable $callback): mixed
+{
+    $logDir = storage_path('logs');
+    if (! is_dir($logDir)) {
+        mkdir($logDir, 0755, true);
+    }
+
+    $renamed = [];
+    foreach (glob($logDir.'/scheduled-*.log') as $log) {
+        $tmp = $log.'.scheduled-jobs-test-bak';
+        rename($log, $tmp);
+        $renamed[$tmp] = $log;
+    }
+
+    try {
+        return $callback($logDir.'/scheduled-'.now()->format('Y-m-d').'.log');
+    } finally {
+        foreach (glob($logDir.'/scheduled-*.log') as $log) {
+            @unlink($log);
+        }
+
+        foreach ($renamed as $tmp => $original) {
+            if (file_exists($tmp)) {
+                rename($tmp, $original);
+            }
+        }
+    }
+}
+
 beforeEach(function () {
     // Create root team (id 0) and root user
     $this->rootTeam = Team::factory()->create(['id' => 0, 'name' => 'Root Team']);
@@ -270,3 +305,96 @@
         rename($tmp, $original);
     }
 });
+
+test('skipped service database backups render with service backup link', function () {
+    $this->actingAs($this->rootUser);
+    session(['currentTeam' => $this->rootTeam]);
+
+    $server = Server::factory()->create(['team_id' => $this->rootTeam->id]);
+    $destination = StandaloneDocker::where('server_id', $server->id)->firstOrFail();
+    $project = Project::factory()->create(['team_id' => $this->rootTeam->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+    $service = Service::factory()->create([
+        'server_id' => $server->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+        'environment_id' => $environment->id,
+    ]);
+    $serviceDatabase = ServiceDatabase::create([
+        'service_id' => $service->id,
+        'name' => 'service-postgres',
+        'image' => 'postgres:16-alpine',
+        'custom_type' => 'postgresql',
+    ]);
+    $backup = ScheduledDatabaseBackup::create([
+        'team_id' => $this->rootTeam->id,
+        'frequency' => '0 * * * *',
+        'database_id' => $serviceDatabase->id,
+        'database_type' => $serviceDatabase->getMorphClass(),
+        'enabled' => true,
+    ]);
+
+    withIsolatedScheduledLogsForMonitoringTest(function (string $logPath) use ($backup, $project, $environment, $service, $serviceDatabase) {
+        file_put_contents(
+            $logPath,
+            '['.now()->format('Y-m-d H:i:s').'] production.INFO: Backup skipped {"type":"backup","skip_reason":"server_not_functional","backup_id":'.$backup->id.',"team_id":'.$this->rootTeam->id.'}'."\n"
+        );
+
+        $expectedUrl = route('project.service.database.backups', [
+            'project_uuid' => $project->uuid,
+            'environment_uuid' => $environment->uuid,
+            'service_uuid' => $service->uuid,
+            'stack_service_uuid' => $serviceDatabase->uuid,
+        ]);
+
+        Livewire::test(ScheduledJobs::class)
+            ->assertOk()
+            ->assertSee('service-postgres')
+            ->assertSeeHtml('href="'.$expectedUrl.'"');
+    });
+});
+
+test('skipped standalone database backups keep standalone backup link', function () {
+    $this->actingAs($this->rootUser);
+    session(['currentTeam' => $this->rootTeam]);
+
+    $server = Server::factory()->create(['team_id' => $this->rootTeam->id]);
+    $destination = StandaloneDocker::where('server_id', $server->id)->firstOrFail();
+    $project = Project::factory()->create(['team_id' => $this->rootTeam->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+    $database = StandalonePostgresql::create([
+        'name' => 'standalone-postgres',
+        'image' => 'postgres:16-alpine',
+        'postgres_user' => 'postgres',
+        'postgres_password' => 'password',
+        'postgres_db' => 'postgres',
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+    ]);
+    $backup = ScheduledDatabaseBackup::create([
+        'team_id' => $this->rootTeam->id,
+        'frequency' => '0 * * * *',
+        'database_id' => $database->id,
+        'database_type' => $database->getMorphClass(),
+        'enabled' => true,
+    ]);
+
+    withIsolatedScheduledLogsForMonitoringTest(function (string $logPath) use ($backup, $project, $environment, $database) {
+        file_put_contents(
+            $logPath,
+            '['.now()->format('Y-m-d H:i:s').'] production.INFO: Backup skipped {"type":"backup","skip_reason":"server_not_functional","backup_id":'.$backup->id.',"team_id":'.$this->rootTeam->id.'}'."\n"
+        );
+
+        $expectedUrl = route('project.database.backup.index', [
+            'project_uuid' => $project->uuid,
+            'environment_uuid' => $environment->uuid,
+            'database_uuid' => $database->uuid,
+        ]);
+
+        Livewire::test(ScheduledJobs::class)
+            ->assertOk()
+            ->assertSee('standalone-postgres')
+            ->assertSeeHtml('href="'.$expectedUrl.'"');
+    });
+});
diff --git a/tests/Feature/TeamScopedDestinationTest.php b/tests/Feature/TeamScopedDestinationTest.php
index bdac0251d..943676ba4 100644
--- a/tests/Feature/TeamScopedDestinationTest.php
+++ b/tests/Feature/TeamScopedDestinationTest.php
@@ -1,5 +1,6 @@
 <?php
 
+use App\Livewire\Destination\Resources as DestinationResources;
 use App\Livewire\Destination\Show as DestinationShow;
 use App\Livewire\Project\New\DockerCompose;
 use App\Livewire\Project\New\DockerImage;
@@ -294,4 +295,80 @@
         expect($component->get('destination'))->toBeNull();
         $component->assertRedirect(route('destination.index'));
     });
+
+    test('general page links to separate resources page without rendering the resources table', function () {
+        Livewire::test(DestinationShow::class, ['destination_uuid' => $this->destinationA->uuid])
+            ->assertSee('General')
+            ->assertSee('Resources')
+            ->assertDontSee('Search resources...')
+            ->assertDontSee('No resources are using this destination.');
+    });
+
+    test('mount with own standalone destination lists deployed resources', function () {
+        Application::factory()->create([
+            'name' => 'application-on-destination',
+            'environment_id' => $this->environmentA->id,
+            'destination_id' => $this->destinationA->id,
+            'destination_type' => StandaloneDocker::class,
+        ]);
+        Service::factory()->create([
+            'name' => 'service-on-destination',
+            'environment_id' => $this->environmentA->id,
+            'destination_id' => $this->destinationA->id,
+            'destination_type' => StandaloneDocker::class,
+        ]);
+        StandalonePostgresql::withoutEvents(fn () => StandalonePostgresql::create([
+            'uuid' => fake()->uuid(),
+            'name' => 'database-on-destination',
+            'postgres_password' => 'password',
+            'environment_id' => $this->environmentA->id,
+            'destination_id' => $this->destinationA->id,
+            'destination_type' => StandaloneDocker::class,
+        ]));
+
+        Livewire::test(DestinationResources::class, ['destination_uuid' => $this->destinationA->uuid])
+            ->assertSee('Search resources...')
+            ->assertSee('Project')
+            ->assertSee('Environment')
+            ->assertSee('Name')
+            ->assertSee('Type')
+            ->assertSee('application-on-destination')
+            ->assertSee('service-on-destination')
+            ->assertSee('database-on-destination')
+            ->assertSee($this->projectA->name)
+            ->assertSee($this->environmentA->name);
+    });
+
+    test('mount with own standalone destination shows empty state without resources', function () {
+        Livewire::test(DestinationResources::class, ['destination_uuid' => $this->destinationA->uuid])
+            ->assertSee('No resources are using this destination.');
+    });
+
+    test('mount with own standalone destination does not list another team resources', function () {
+        Application::factory()->create([
+            'name' => 'other-team-application',
+            'environment_id' => $this->environmentB->id,
+            'destination_id' => $this->destinationB->id,
+            'destination_type' => StandaloneDocker::class,
+        ]);
+
+        Livewire::test(DestinationResources::class, ['destination_uuid' => $this->destinationA->uuid])
+            ->assertDontSee('other-team-application');
+    });
+
+    test('resource without project renders as non-clickable row', function () {
+        StandalonePostgresql::withoutEvents(fn () => StandalonePostgresql::create([
+            'uuid' => fake()->uuid(),
+            'name' => 'database-without-project',
+            'postgres_password' => 'password',
+            'environment_id' => null,
+            'destination_id' => $this->destinationA->id,
+            'destination_type' => StandaloneDocker::class,
+        ]));
+
+        $component = Livewire::test(DestinationResources::class, ['destination_uuid' => $this->destinationA->uuid])
+            ->assertSee('database-without-project');
+
+        expect($component->html())->not->toContain('href=""');
+    });
 });
diff --git a/tests/Feature/UpgradeComponentTest.php b/tests/Feature/UpgradeComponentTest.php
index 896e0fa3b..aae32a7f7 100644
--- a/tests/Feature/UpgradeComponentTest.php
+++ b/tests/Feature/UpgradeComponentTest.php
@@ -17,7 +17,7 @@
 
     Cache::shouldReceive('remember')
         ->once()
-        ->with('coolify:versions:all', 3600, Mockery::type(\Closure::class))
+        ->with('coolify:versions:all', 3600, Mockery::type(Closure::class))
         ->andReturn([
             'coolify' => [
                 'v4' => [
@@ -42,7 +42,7 @@
 
     Cache::shouldReceive('remember')
         ->once()
-        ->with('coolify:versions:all', 3600, Mockery::type(\Closure::class))
+        ->with('coolify:versions:all', 3600, Mockery::type(Closure::class))
         ->andReturn(null);
 
     Livewire::test(Upgrade::class)
@@ -58,7 +58,7 @@
 
     Cache::shouldReceive('remember')
         ->once()
-        ->with('coolify:versions:all', 3600, Mockery::type(\Closure::class))
+        ->with('coolify:versions:all', 3600, Mockery::type(Closure::class))
         ->andReturn([
             'coolify' => [
                 'v4' => [
@@ -83,7 +83,7 @@
 
     Cache::shouldReceive('remember')
         ->once()
-        ->with('coolify:versions:all', 3600, Mockery::type(\Closure::class))
+        ->with('coolify:versions:all', 3600, Mockery::type(Closure::class))
         ->andReturn([
             'coolify' => [
                 'v4' => [
diff --git a/tests/Unit/Actions/Server/CleanupDockerTest.php b/tests/Unit/Actions/Server/CleanupDockerTest.php
index 1a6a0d3d6..a70f07d15 100644
--- a/tests/Unit/Actions/Server/CleanupDockerTest.php
+++ b/tests/Unit/Actions/Server/CleanupDockerTest.php
@@ -447,6 +447,15 @@
     expect($sourceFile)->toContain('label=coolify.managed=true');
 });
 
+it('uses persisted buildx metadata when pruning the railpack builder', function () {
+    $sourceFile = file_get_contents(__DIR__.'/../../../../app/Actions/Server/CleanupDocker.php');
+
+    expect($sourceFile)
+        ->toContain('docker run --rm -v \\$HOME/.docker/buildx:/root/.docker/buildx')
+        ->toContain('docker buildx prune --builder coolify-railpack -af')
+        ->not->toContain('--buildkitd-flags');
+});
+
 it('preserves build image for currently running tag', function () {
     $images = collect([
         ['repository' => 'app-uuid', 'tag' => 'commit1', 'created_at' => '2024-01-01 10:00:00', 'image_ref' => 'app-uuid:commit1'],
diff --git a/tests/Unit/ApplicationDeploymentRailpackBuildxMetadataTest.php b/tests/Unit/ApplicationDeploymentRailpackBuildxMetadataTest.php
new file mode 100644
index 000000000..70b021f0a
--- /dev/null
+++ b/tests/Unit/ApplicationDeploymentRailpackBuildxMetadataTest.php
@@ -0,0 +1,11 @@
+<?php
+
+it('persists buildx metadata between the helper container and host cleanup', function () {
+    $sourceFile = file_get_contents(__DIR__.'/../../app/Jobs/ApplicationDeploymentJob.php');
+
+    expect($sourceFile)
+        ->toContain('mkdir -p {$this->serverUserHomeDir}/.docker/buildx')
+        ->toContain('-v {$this->serverUserHomeDir}/.docker/buildx:/root/.docker/buildx');
+
+    expect(substr_count($sourceFile, '{$buildxMetadataVolume} -v /var/run/docker.sock:/var/run/docker.sock'))->toBe(3);
+});
diff --git a/tests/Unit/DeployKeyDedicatedPathTest.php b/tests/Unit/DeployKeyDedicatedPathTest.php
new file mode 100644
index 000000000..a3373f42a
--- /dev/null
+++ b/tests/Unit/DeployKeyDedicatedPathTest.php
@@ -0,0 +1,189 @@
+<?php
+
+use App\Models\Application;
+use App\Models\ApplicationSetting;
+use App\Models\GitlabApp;
+use App\Models\PrivateKey;
+
+afterEach(function () {
+    Mockery::close();
+});
+
+/**
+ * Git operations authenticate with the SSH key assigned in the UI. Coolify writes that key to a
+ * per-deployment path (/root/.ssh/id_rsa_coolify_<deployment_uuid>) instead of the shared
+ * /root/.ssh/id_rsa, so it can neither overwrite the server root's own key nor race with other
+ * concurrent operations on the same host. `-o IdentitiesOnly=yes` makes ssh offer only that key.
+ * On the host path an EXIT trap removes the key when the shell finishes; the docker path runs in an
+ * ephemeral container, so it needs no cleanup.
+ */
+$keyPath = '/root/.ssh/id_rsa_coolify_test-deployment-uuid';
+
+it('writes a deploy key to a per-deployment path and cleans it up for ls-remote on the host', function () use ($keyPath) {
+    $privateKey = Mockery::mock(PrivateKey::class)->makePartial();
+    $privateKey->shouldReceive('getAttribute')->with('private_key')->andReturn('fake-private-key');
+
+    $application = Mockery::mock(Application::class)->makePartial();
+    $application->git_branch = 'main';
+    $application->shouldReceive('deploymentType')->andReturn('deploy_key');
+    $application->shouldReceive('customRepository')->andReturn(['repository' => 'git@gitlab.com:user/repo.git', 'port' => 22]);
+    $application->shouldReceive('getAttribute')->with('private_key')->andReturn($privateKey);
+
+    $result = $application->generateGitLsRemoteCommands('test-deployment-uuid', false);
+
+    expect($result['commands'])
+        ->toContain("tee {$keyPath}")
+        ->toContain("-i {$keyPath} -o IdentitiesOnly=yes")
+        ->toContain("trap 'rm -f {$keyPath}' EXIT") // removed when the shell exits
+        ->not->toContain('tee /root/.ssh/id_rsa >'); // never overwrites the host root's own key
+});
+
+it('writes a deploy key to a per-deployment path for ls-remote inside docker without a trap', function () use ($keyPath) {
+    $privateKey = Mockery::mock(PrivateKey::class)->makePartial();
+    $privateKey->shouldReceive('getAttribute')->with('private_key')->andReturn('fake-private-key');
+
+    $application = Mockery::mock(Application::class)->makePartial();
+    $application->git_branch = 'main';
+    $application->shouldReceive('deploymentType')->andReturn('deploy_key');
+    $application->shouldReceive('customRepository')->andReturn(['repository' => 'git@gitlab.com:user/repo.git', 'port' => 22]);
+    $application->shouldReceive('getAttribute')->with('private_key')->andReturn($privateKey);
+
+    $result = $application->generateGitLsRemoteCommands('test-deployment-uuid', true);
+
+    expect($result['commands'])
+        ->toContain("tee {$keyPath}")
+        ->toContain("-i {$keyPath} -o IdentitiesOnly=yes")
+        ->not->toContain('trap ') // ephemeral container, no cleanup needed
+        ->not->toContain('tee /root/.ssh/id_rsa >');
+});
+
+it('writes a GitLab source private key to a per-deployment path with cleanup on the host', function () use ($keyPath) {
+    $privateKey = Mockery::mock(PrivateKey::class)->makePartial();
+    $privateKey->shouldReceive('getAttribute')->with('private_key')->andReturn('fake-private-key');
+
+    $gitlabSource = Mockery::mock(GitlabApp::class)->makePartial();
+    $gitlabSource->shouldReceive('getMorphClass')->andReturn(GitlabApp::class);
+    $gitlabSource->shouldReceive('getAttribute')->with('html_url')->andReturn('https://gitlab.com');
+    $gitlabSource->shouldReceive('getAttribute')->with('privateKey')->andReturn($privateKey);
+    $gitlabSource->shouldReceive('getAttribute')->with('private_key_id')->andReturn(1);
+    $gitlabSource->shouldReceive('getAttribute')->with('custom_port')->andReturn(22);
+
+    $application = Mockery::mock(Application::class)->makePartial();
+    $application->git_branch = 'main';
+    $application->shouldReceive('deploymentType')->andReturn('source');
+    $application->shouldReceive('customRepository')->andReturn(['repository' => 'git@gitlab.com:user/repo.git', 'port' => 22]);
+    $application->shouldReceive('getAttribute')->with('source')->andReturn($gitlabSource);
+    $application->source = $gitlabSource;
+
+    $result = $application->generateGitLsRemoteCommands('test-deployment-uuid', false);
+
+    expect($result['commands'])
+        ->toContain("tee {$keyPath}")
+        ->toContain("-i {$keyPath} -o IdentitiesOnly=yes")
+        ->toContain("trap 'rm -f {$keyPath}' EXIT")
+        ->not->toContain('tee /root/.ssh/id_rsa >');
+});
+
+it('writes a deploy key to a per-deployment path and cleans it up when cloning on the host', function () use ($keyPath) {
+    $privateKey = Mockery::mock(PrivateKey::class)->makePartial();
+    $privateKey->shouldReceive('getAttribute')->with('private_key')->andReturn('fake-private-key');
+
+    $settings = Mockery::mock(ApplicationSetting::class)->makePartial();
+    $settings->shouldReceive('getAttribute')->with('is_git_shallow_clone_enabled')->andReturn(false);
+    $settings->shouldReceive('getAttribute')->with('is_git_submodules_enabled')->andReturn(false);
+    $settings->shouldReceive('getAttribute')->with('is_git_lfs_enabled')->andReturn(false);
+
+    $application = Mockery::mock(Application::class)->makePartial();
+    $application->git_branch = 'main';
+    $application->shouldReceive('deploymentType')->andReturn('deploy_key');
+    $application->shouldReceive('customRepository')->andReturn(['repository' => 'git@gitlab.com:user/repo.git', 'port' => 22]);
+    $application->shouldReceive('getAttribute')->with('private_key')->andReturn($privateKey);
+    $application->shouldReceive('getAttribute')->with('settings')->andReturn($settings);
+    $application->shouldReceive('getAttribute')->with('git_commit_sha')->andReturn('HEAD');
+
+    // exec_in_docker = false → the loadComposeFile / host clone path
+    $result = $application->generateGitImportCommands('test-deployment-uuid', 0, null, false);
+
+    expect($result['commands'])
+        ->toContain("tee {$keyPath}")
+        ->toContain("-i {$keyPath} -o IdentitiesOnly=yes")
+        ->toContain("trap 'rm -f {$keyPath}' EXIT")
+        ->not->toContain('tee /root/.ssh/id_rsa >');
+});
+
+it('writes a GitLab source private key to a per-deployment path and cleans it up when cloning on the host', function () use ($keyPath) {
+    $privateKey = Mockery::mock(PrivateKey::class)->makePartial();
+    $privateKey->shouldReceive('getAttribute')->with('private_key')->andReturn('fake-private-key');
+
+    $gitlabSource = Mockery::mock(GitlabApp::class)->makePartial();
+    $gitlabSource->shouldReceive('getMorphClass')->andReturn(GitlabApp::class);
+    $gitlabSource->shouldReceive('getAttribute')->with('html_url')->andReturn('https://gitlab.com');
+    $gitlabSource->shouldReceive('getAttribute')->with('privateKey')->andReturn($privateKey);
+    $gitlabSource->shouldReceive('getAttribute')->with('custom_port')->andReturn(22);
+
+    $settings = Mockery::mock(ApplicationSetting::class)->makePartial();
+    $settings->shouldReceive('getAttribute')->with('is_git_shallow_clone_enabled')->andReturn(false);
+    $settings->shouldReceive('getAttribute')->with('is_git_submodules_enabled')->andReturn(false);
+    $settings->shouldReceive('getAttribute')->with('is_git_lfs_enabled')->andReturn(false);
+
+    $application = Mockery::mock(Application::class)->makePartial();
+    $application->git_branch = 'main';
+    $application->source = $gitlabSource;
+    $application->shouldReceive('deploymentType')->andReturn('source');
+    $application->shouldReceive('customRepository')->andReturn(['repository' => 'git@gitlab.com:user/repo.git', 'port' => 22]);
+    $application->shouldReceive('getAttribute')->with('source')->andReturn($gitlabSource);
+    $application->shouldReceive('getAttribute')->with('settings')->andReturn($settings);
+    $application->shouldReceive('getAttribute')->with('git_commit_sha')->andReturn('HEAD');
+
+    $result = $application->generateGitImportCommands('test-deployment-uuid', 0, null, false);
+
+    expect($result['commands'])
+        ->toContain("tee {$keyPath}")
+        ->toContain("-i {$keyPath} -o IdentitiesOnly=yes")
+        ->toContain("trap 'rm -f {$keyPath}' EXIT")
+        ->not->toContain('tee /root/.ssh/id_rsa >');
+});
+
+it('uses the per-deployment deploy key for pull request fetches', function () use ($keyPath) {
+    $privateKey = Mockery::mock(PrivateKey::class)->makePartial();
+    $privateKey->shouldReceive('getAttribute')->with('private_key')->andReturn('fake-private-key');
+
+    $settings = Mockery::mock(ApplicationSetting::class)->makePartial();
+    $settings->shouldReceive('getAttribute')->with('is_git_shallow_clone_enabled')->andReturn(false);
+    $settings->shouldReceive('getAttribute')->with('is_git_submodules_enabled')->andReturn(false);
+    $settings->shouldReceive('getAttribute')->with('is_git_lfs_enabled')->andReturn(false);
+
+    $application = Mockery::mock(Application::class)->makePartial();
+    $application->git_branch = 'main';
+    $application->shouldReceive('deploymentType')->andReturn('deploy_key');
+    $application->shouldReceive('customRepository')->andReturn(['repository' => 'git@github.com:user/repo.git', 'port' => 22]);
+    $application->shouldReceive('getAttribute')->with('private_key')->andReturn($privateKey);
+    $application->shouldReceive('getAttribute')->with('settings')->andReturn($settings);
+    $application->shouldReceive('getAttribute')->with('git_commit_sha')->andReturn('HEAD');
+
+    $result = $application->generateGitImportCommands('test-deployment-uuid', 123, 'github', false);
+
+    expect($result['commands'])
+        ->toContain("GIT_SSH_COMMAND=\"ssh -o ConnectTimeout=30 -p 22 -o Port=22 -o LogLevel=ERROR -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i {$keyPath} -o IdentitiesOnly=yes\" git fetch origin pull/123/head:pr-123-coolify")
+        ->not->toContain('GIT_SSH_COMMAND="ssh -o ConnectTimeout=30 -p 22 -o Port=22 -o LogLevel=ERROR -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i /root/.ssh/id_rsa" git fetch origin pull/123/head:pr-123-coolify');
+});
+
+it('does not force a missing per-deployment key for other repository pull request fetches', function () use ($keyPath) {
+    $settings = Mockery::mock(ApplicationSetting::class)->makePartial();
+    $settings->shouldReceive('getAttribute')->with('is_git_shallow_clone_enabled')->andReturn(false);
+    $settings->shouldReceive('getAttribute')->with('is_git_submodules_enabled')->andReturn(false);
+    $settings->shouldReceive('getAttribute')->with('is_git_lfs_enabled')->andReturn(false);
+
+    $application = Mockery::mock(Application::class)->makePartial();
+    $application->git_branch = 'main';
+    $application->shouldReceive('deploymentType')->andReturn('other');
+    $application->shouldReceive('customRepository')->andReturn(['repository' => 'git@github.com:user/repo.git', 'port' => 22]);
+    $application->shouldReceive('getAttribute')->with('settings')->andReturn($settings);
+    $application->shouldReceive('getAttribute')->with('git_commit_sha')->andReturn('HEAD');
+
+    $result = $application->generateGitImportCommands('test-deployment-uuid', 123, 'github', false);
+
+    expect($result['commands'])
+        ->toContain('GIT_SSH_COMMAND="ssh -o ConnectTimeout=30 -p 22 -o Port=22 -o LogLevel=ERROR -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i /root/.ssh/id_rsa" git fetch origin pull/123/head:pr-123-coolify')
+        ->not->toContain($keyPath);
+});
diff --git a/tests/Unit/GitHubAppSubmoduleCredentialsTest.php b/tests/Unit/GitHubAppSubmoduleCredentialsTest.php
index 48f18d2a5..36266fce6 100644
--- a/tests/Unit/GitHubAppSubmoduleCredentialsTest.php
+++ b/tests/Unit/GitHubAppSubmoduleCredentialsTest.php
@@ -42,8 +42,8 @@ function generateGithubInstallationToken(GithubApp $source): string
 
         expect($result['commands'])
             ->not->toContain('git config --global')
-            ->toContain("git -c 'url.https://x-access-token:review%20token%2Fwith%2Bsymbols@github.com/.insteadOf=https://github.com/' clone --recurse-submodules -b 'main'")
-            ->toContain("git -c 'url.https://x-access-token:review%20token%2Fwith%2Bsymbols@github.com/.insteadOf=https://github.com/' submodule sync")
-            ->toContain("git -c 'url.https://x-access-token:review%20token%2Fwith%2Bsymbols@github.com/.insteadOf=https://github.com/' submodule update --init --recursive");
+            ->toContain("git -c 'url.https://x-access-token:review%20token%2Fwith%2Bsymbols@github.com/.insteadOf=https://github.com/' -c http.version=HTTP/1.1 clone --recurse-submodules -b 'main'")
+            ->toContain("git -c 'url.https://x-access-token:review%20token%2Fwith%2Bsymbols@github.com/.insteadOf=https://github.com/' -c http.version=HTTP/1.1 submodule sync")
+            ->toContain("git -c 'url.https://x-access-token:review%20token%2Fwith%2Bsymbols@github.com/.insteadOf=https://github.com/' -c http.version=HTTP/1.1 submodule update --init --recursive");
     });
 }
diff --git a/tests/Unit/GitSubmoduleCredentialTest.php b/tests/Unit/GitSubmoduleCredentialTest.php
index 5ac5c501a..d22e1ad4c 100644
--- a/tests/Unit/GitSubmoduleCredentialTest.php
+++ b/tests/Unit/GitSubmoduleCredentialTest.php
@@ -156,7 +156,7 @@
             exec_in_docker: false,
         );
 
-        $sshCommand = 'ssh -o ConnectTimeout=30 -p 22 -o Port=22 -o LogLevel=ERROR -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i /root/.ssh/id_rsa';
+        $sshCommand = 'ssh -o ConnectTimeout=30 -p 22 -o Port=22 -o LogLevel=ERROR -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i /root/.ssh/id_rsa_coolify_test-uuid -o IdentitiesOnly=yes';
 
         expect($result['commands'])
             ->toContain('GIT_SSH_COMMAND="'.$sshCommand.'" git fetch origin merge-requests/123/head:pr-123-coolify')
diff --git a/tests/Unit/LogViewerXssSecurityTest.php b/tests/Unit/LogViewerXssSecurityTest.php
index 98c5df3f1..0c682c13c 100644
--- a/tests/Unit/LogViewerXssSecurityTest.php
+++ b/tests/Unit/LogViewerXssSecurityTest.php
@@ -1,427 +1,77 @@
 <?php
 
-/**
- * Security tests for log viewer XSS prevention
- *
- * These tests verify that the log viewer components properly sanitize
- * HTML content to prevent cross-site scripting (XSS) attacks.
- */
+function renderedDataLineTextValue(string $logContent): string
+{
+    $escapedContent = e($logContent);
+    $html = '<span data-line-text="'.$escapedContent.'">'.$escapedContent.'</span>';
+
+    $document = new DOMDocument;
+    $document->loadHTML($html, LIBXML_HTML_NOIMPLIED | LIBXML_HTML_NODEFDTD);
+
+    return $document->documentElement->getAttribute('data-line-text');
+}
+
+describe('Log Viewer HTML Tag Preservation', function () {
+    it('lets Blade escape deployment log data attributes only once', function () {
+        $view = file_get_contents(__DIR__.'/../../resources/views/livewire/project/application/deployment/show.blade.php');
+
+        expect($view)
+            ->toContain('data-log-content="{{ $searchableContent }}"')
+            ->toContain('data-line-text="{{ $lineContent }}"')
+            ->not->toContain('data-log-content="{{ htmlspecialchars($searchableContent) }}"')
+            ->not->toContain('data-line-text="{{ htmlspecialchars($lineContent) }}"');
+    });
+
+    it('preserves literal html-like log text for client-side search reset and highlighting', function () {
+        $logContent = '<div>A</div>';
+
+        expect(renderedDataLineTextValue($logContent))->toBe($logContent);
+    });
+
+    it('does not strip tags with DOMParser based html decoding', function () {
+        $views = [
+            __DIR__.'/../../resources/views/livewire/project/application/deployment/show.blade.php',
+            __DIR__.'/../../resources/views/livewire/project/shared/get-logs.blade.php',
+        ];
+
+        foreach ($views as $view) {
+            expect(file_get_contents($view))
+                ->not->toContain('decodeHtml(text)')
+                ->not->toContain('DOMParser().parseFromString');
+        }
+    });
+});
+
 describe('Log Viewer XSS Prevention', function () {
-    it('escapes script tags in log output', function () {
+    it('keeps script-like log output as text in Blade rendered markup', function () {
         $maliciousLog = '<script>alert("XSS")</script>';
-        $escaped = htmlspecialchars($maliciousLog);
+        $escapedLog = e($maliciousLog);
 
-        expect($escaped)->toContain('&lt;script&gt;');
-        expect($escaped)->not->toContain('<script>');
+        expect($escapedLog)
+            ->toContain('&lt;script&gt;')
+            ->not->toContain('<script>');
     });
 
-    it('escapes event handler attributes', function () {
-        $maliciousLog = '<img src=x onerror="alert(\'XSS\')">';
-        $escaped = htmlspecialchars($maliciousLog);
+    it('keeps dangerous attributes as literal dataset text for textContent rendering', function () {
+        $maliciousLog = '<img src=x onerror="alert(1)">';
 
-        expect($escaped)->toContain('&lt;img');
-        expect($escaped)->toContain('onerror');
-        expect($escaped)->not->toContain('<img');
-        expect($escaped)->not->toContain('onerror="alert');
+        expect(renderedDataLineTextValue($maliciousLog))->toBe($maliciousLog);
     });
 
-    it('escapes javascript: protocol URLs', function () {
-        $maliciousLog = '<a href="javascript:alert(\'XSS\')">click</a>';
-        $escaped = htmlspecialchars($maliciousLog);
+    it('uses text nodes for search highlighting instead of injected html', function () {
+        $views = [
+            __DIR__.'/../../resources/views/livewire/project/application/deployment/show.blade.php',
+            __DIR__.'/../../resources/views/livewire/project/shared/get-logs.blade.php',
+        ];
 
-        expect($escaped)->toContain('&lt;a');
-        expect($escaped)->toContain('javascript:');
-        expect($escaped)->not->toContain('<a href=');
-    });
+        foreach ($views as $view) {
+            $contents = file_get_contents($view);
 
-    it('escapes data: URLs with scripts', function () {
-        $maliciousLog = '<iframe src="data:text/html,<script>alert(\'XSS\')</script>">';
-        $escaped = htmlspecialchars($maliciousLog);
-
-        expect($escaped)->toContain('&lt;iframe');
-        expect($escaped)->toContain('data:');
-        expect($escaped)->not->toContain('<iframe');
-    });
-
-    it('escapes style-based XSS attempts', function () {
-        $maliciousLog = '<div style="background:url(\'javascript:alert(1)\')">test</div>';
-        $escaped = htmlspecialchars($maliciousLog);
-
-        expect($escaped)->toContain('&lt;div');
-        expect($escaped)->toContain('style');
-        expect($escaped)->not->toContain('<div style=');
-    });
-
-    it('escapes Alpine.js directive injection', function () {
-        $maliciousLog = '<div x-html="alert(\'XSS\')">test</div>';
-        $escaped = htmlspecialchars($maliciousLog);
-
-        expect($escaped)->toContain('&lt;div');
-        expect($escaped)->toContain('x-html');
-        expect($escaped)->not->toContain('<div x-html=');
-    });
-
-    it('escapes multiple HTML entities', function () {
-        $maliciousLog = '<>&"\'';
-        $escaped = htmlspecialchars($maliciousLog);
-
-        expect($escaped)->toBe('&lt;&gt;&amp;&quot;&#039;');
-    });
-
-    it('preserves legitimate text content', function () {
-        $legitimateLog = 'INFO: Application started successfully';
-        $escaped = htmlspecialchars($legitimateLog);
-
-        expect($escaped)->toBe($legitimateLog);
-    });
-
-    it('handles ANSI color codes after escaping', function () {
-        $logWithAnsi = "\e[31mERROR:\e[0m Something went wrong";
-        $escaped = htmlspecialchars($logWithAnsi);
-
-        // ANSI codes should be preserved in escaped form
-        expect($escaped)->toContain('ERROR');
-        expect($escaped)->toContain('Something went wrong');
-    });
-
-    it('escapes complex nested HTML structures', function () {
-        $maliciousLog = '<div onclick="alert(1)"><img src=x onerror="alert(2)"><script>alert(3)</script></div>';
-        $escaped = htmlspecialchars($maliciousLog);
-
-        expect($escaped)->toContain('&lt;div');
-        expect($escaped)->toContain('&lt;img');
-        expect($escaped)->toContain('&lt;script&gt;');
-        expect($escaped)->not->toContain('<div');
-        expect($escaped)->not->toContain('<img');
-        expect($escaped)->not->toContain('<script>');
-    });
-});
-
-/**
- * Tests for x-text security approach
- *
- * These tests verify that using x-text instead of x-html eliminates XSS risks
- * by rendering all content as plain text rather than HTML.
- */
-describe('x-text Security', function () {
-    it('verifies x-text renders content as plain text, not HTML', function () {
-        // x-text always renders as textContent, never as innerHTML
-        // This means any HTML tags in the content are displayed as literal text
-        $contentWithHtml = '<script>alert("XSS")</script>';
-        $escaped = htmlspecialchars($contentWithHtml);
-
-        // When stored in data attribute and rendered with x-text:
-        // 1. Server escapes to: &lt;script&gt;alert(&quot;XSS&quot;)&lt;/script&gt;
-        // 2. Browser decodes the attribute value to: <script>alert("XSS")</script>
-        // 3. x-text renders it as textContent (plain text), NOT innerHTML
-        // 4. Result: User sees "<script>alert("XSS")</script>" as text, script never executes
-
-        expect($escaped)->toContain('&lt;script&gt;');
-        expect($escaped)->not->toContain('<script>');
-    });
-
-    it('confirms x-text prevents Alpine.js directive injection', function () {
-        $maliciousContent = '<div x-data="{ evil: true }" x-html="alert(1)">test</div>';
-        $escaped = htmlspecialchars($maliciousContent);
-
-        // Even if attacker includes Alpine directives in log content:
-        // 1. Server escapes them
-        // 2. x-text renders as plain text
-        // 3. Alpine never processes these as directives
-        // 4. User just sees the literal text
-
-        expect($escaped)->toContain('x-data');
-        expect($escaped)->toContain('x-html');
-        expect($escaped)->not->toContain('<div x-data=');
-    });
-
-    it('verifies x-text prevents event handler execution', function () {
-        $maliciousContent = '<img src=x onerror="alert(\'XSS\')">';
-        $escaped = htmlspecialchars($maliciousContent);
-
-        // With x-text approach:
-        // 1. Content is escaped on server
-        // 2. Rendered as textContent, not innerHTML
-        // 3. No HTML parsing means no event handlers
-        // 4. User sees the literal text, no image is rendered, no event fires
-
-        expect($escaped)->toContain('&lt;img');
-        expect($escaped)->toContain('onerror');
-        expect($escaped)->not->toContain('<img');
-    });
-
-    it('verifies x-text prevents style-based attacks', function () {
-        $maliciousContent = '<style>body { display: none; }</style>';
-        $escaped = htmlspecialchars($maliciousContent);
-
-        // x-text renders everything as text:
-        // 1. Style tags never get parsed as HTML
-        // 2. CSS never gets applied
-        // 3. User just sees the literal style tag content
-
-        expect($escaped)->toContain('&lt;style&gt;');
-        expect($escaped)->not->toContain('<style>');
-    });
-
-    it('confirms CSS class-based highlighting is safe', function () {
-        // New approach uses CSS classes for highlighting instead of injecting HTML
-        // The 'log-highlight' class is applied via Alpine.js :class binding
-        // This is safe because:
-        // 1. Class names are controlled by JavaScript, not user input
-        // 2. No HTML injection occurs
-        // 3. CSS provides visual feedback without executing code
-
-        $highlightClass = 'log-highlight';
-        expect($highlightClass)->toBe('log-highlight');
-        expect($highlightClass)->not->toContain('<');
-        expect($highlightClass)->not->toContain('script');
-    });
-
-    it('verifies granular highlighting only marks matching text', function () {
-        // splitTextForHighlight() divides text into parts
-        // Only matching portions get highlight: true
-        // Each part is rendered with x-text (safe plain text)
-        // Highlight class applied only to matching spans
-
-        $logLine = 'ERROR: Database connection failed';
-        $searchQuery = 'ERROR';
-
-        // When searching for "ERROR":
-        // Part 1: { text: "ERROR", highlight: true }  <- highlighted
-        // Part 2: { text: ": Database connection failed", highlight: false }  <- not highlighted
-
-        // This ensures only the search term is highlighted, not the entire line
-        expect($logLine)->toContain($searchQuery);
-        expect(strlen($searchQuery))->toBeLessThan(strlen($logLine));
-    });
-});
-
-/**
- * Integration documentation tests
- *
- * These tests document the expected flow of log sanitization with x-text
- */
-describe('Log Sanitization Flow with x-text', function () {
-    it('documents the secure x-text rendering flow', function () {
-        $rawLog = '<script>alert("XSS")</script>';
-
-        // Step 1: Server-side escaping (PHP)
-        $escaped = htmlspecialchars($rawLog);
-        expect($escaped)->toBe('&lt;script&gt;alert(&quot;XSS&quot;)&lt;/script&gt;');
-
-        // Step 2: Stored in data-log-content attribute
-        // <div data-log-content="&lt;script&gt;alert(&quot;XSS&quot;)&lt;/script&gt;" x-text="getDisplayText($el.dataset.logContent)">
-
-        // Step 3: Client-side getDisplayText() decodes HTML entities
-        // const decoded = doc.documentElement.textContent;
-        // Result: '<script>alert("XSS")</script>' (as text string)
-
-        // Step 4: x-text renders as textContent (NOT innerHTML)
-        // Alpine.js sets element.textContent = decoded
-        // Result: Browser displays '<script>alert("XSS")</script>' as visible text
-        // The script tag is never parsed or executed - it's just text
-
-        // Step 5: Highlighting via CSS class
-        // If search query matches, 'log-highlight' class is added
-        // Visual feedback is provided through CSS, not HTML injection
-    });
-
-    it('documents search highlighting with CSS classes', function () {
-        $legitimateLog = '2024-01-01T12:00:00.000Z ERROR: Database connection failed';
-
-        // Server-side: Escape and store
-        $escaped = htmlspecialchars($legitimateLog);
-        expect($escaped)->toBe($legitimateLog); // No special chars
-
-        // Client-side: If user searches for "ERROR"
-        // 1. splitTextForHighlight() divides the text into parts:
-        //    - Part 1: "2024-01-01T12:00:00.000Z " (highlight: false)
-        //    - Part 2: "ERROR" (highlight: true) <- This part gets highlighted
-        //    - Part 3: ": Database connection failed" (highlight: false)
-        // 2. Each part is rendered as a <span> with x-text (safe)
-        // 3. Only Part 2 gets the 'log-highlight' class via :class binding
-        // 4. CSS provides yellow/warning background color on "ERROR" only
-        // 5. No HTML injection occurs - just multiple safe text spans
-
-        expect($legitimateLog)->toContain('ERROR');
-    });
-
-    it('verifies no HTML injection occurs during search', function () {
-        $logWithHtml = 'User input: <img src=x onerror="alert(1)">';
-        $escaped = htmlspecialchars($logWithHtml);
-
-        // Even if log contains malicious HTML:
-        // 1. Server escapes it
-        // 2. x-text renders as plain text
-        // 3. Search highlighting uses CSS class, not HTML tags
-        // 4. User sees the literal text with highlight background
-        // 5. No script execution possible
-
-        expect($escaped)->toContain('&lt;img');
-        expect($escaped)->toContain('onerror');
-        expect($escaped)->not->toContain('<img src=');
-    });
-
-    it('documents that user search queries cannot inject HTML', function () {
-        // User search query is only used in:
-        // 1. String matching (includes() check) - safe
-        // 2. CSS class application - safe (class name is hardcoded)
-        // 3. Match counting - safe (just text comparison)
-
-        // User query is NOT used in:
-        // 1. HTML generation - eliminated by switching to x-text
-        // 2. innerHTML assignment - x-text uses textContent only
-        // 3. DOM manipulation - only CSS classes are applied
-
-        $userSearchQuery = '<script>alert("XSS")</script>';
-
-        // The search query is used in matchesSearch() which does:
-        // line.toLowerCase().includes(this.searchQuery.toLowerCase())
-        // This is safe string comparison, no HTML parsing
-
-        expect($userSearchQuery)->toContain('<script>');
-        // But it's only used for string matching, never rendered as HTML
-    });
-});
-
-/**
- * Tests for DoS prevention in HTML entity decoding
- *
- * These tests verify that the decodeHtml() function in the client-side JavaScript
- * has proper safeguards against deeply nested HTML entities that could cause DoS.
- */
-describe('HTML Entity Decoding DoS Prevention', function () {
-    it('documents the DoS vulnerability with unbounded decoding', function () {
-        // Without a max iteration limit, an attacker could provide deeply nested entities:
-        // &amp;amp;amp;amp;amp;amp;amp;amp;amp;amp; (10 levels deep)
-        // Each iteration decodes one level, causing excessive CPU usage
-
-        $normalEntity = '&amp;lt;script&gt;';
-        // Normal case: 2-3 iterations to fully decode
-        expect($normalEntity)->toContain('&amp;');
-    });
-
-    it('verifies max iteration limit prevents DoS', function () {
-        // The decodeHtml() function should have a maxIterations constant (e.g., 3)
-        // This ensures even with deeply nested entities, decoding stops after 3 iterations
-        // Preventing CPU exhaustion from malicious input
-
-        $deeplyNested = '&amp;amp;amp;amp;amp;amp;amp;amp;lt;';
-        // With max 3 iterations, only first 3 levels decoded
-        // Remaining nesting is preserved but doesn't cause DoS
-
-        // This test documents that the limit exists
-        expect(strlen($deeplyNested))->toBeGreaterThan(10);
-    });
-
-    it('documents normal use cases work within iteration limit', function () {
-        // Legitimate double-encoding (common in logs): &amp;lt;
-        // Iteration 1: &<
-        // Iteration 2: <
-        // Total: 2 iterations (well within limit of 3)
-
-        $doubleEncoded = '&amp;lt;script&amp;gt;';
-        expect($doubleEncoded)->toContain('&amp;');
-
-        // Triple-encoding (rare but possible): &amp;amp;lt;
-        // Iteration 1: &amp;<
-        // Iteration 2: &<
-        // Iteration 3: <
-        // Total: 3 iterations (exactly at limit)
-
-        $tripleEncoded = '&amp;amp;lt;div&amp;amp;gt;';
-        expect($tripleEncoded)->toContain('&amp;amp;');
-    });
-
-    it('documents that iteration limit is sufficient for real-world logs', function () {
-        // Analysis of real-world log encoding scenarios:
-        // 1. Single encoding: 1 iteration
-        // 2. Double encoding (logs passed through multiple systems): 2 iterations
-        // 3. Triple encoding (rare edge case): 3 iterations
-        // 4. Beyond triple encoding: Likely malicious or severely misconfigured
-
-        // The maxIterations = 3 provides:
-        // - Protection against DoS attacks
-        // - Support for all legitimate use cases
-        // - Predictable performance characteristics
-
-        expect(3)->toBeGreaterThanOrEqual(3); // Max iterations covers all legitimate cases
-    });
-
-    it('verifies decoding stops at max iterations even with malicious input', function () {
-        // With maxIterations = 3, decoding flow:
-        // Input: &amp;amp;amp;amp;amp; (5 levels)
-        // Iteration 1: &amp;amp;amp;amp;
-        // Iteration 2: &amp;amp;amp;
-        // Iteration 3: &amp;amp;
-        // Stop: Max iterations reached
-        // Output: &amp; (partially decoded, but safe from DoS)
-
-        $maliciousInput = str_repeat('&amp;', 10).'lt;script&gt;';
-        // Even with 10 levels of nesting, function stops at 3 iterations
-        expect(strlen($maliciousInput))->toBeGreaterThan(50);
-        // The point is NOT that we fully decode it, but that we don't loop forever
-    });
-
-    it('confirms while loop condition includes iteration check', function () {
-        // The vulnerable code was:
-        // while (decoded !== prev) { ... }
-        //
-        // The fixed code should be:
-        // while (decoded !== prev && iterations < maxIterations) { ... }
-        //
-        // This ensures the loop ALWAYS terminates after maxIterations
-
-        $condition = 'iterations < maxIterations';
-        expect($condition)->toContain('maxIterations');
-        expect($condition)->toContain('<');
-    });
-
-    it('documents performance impact of iteration limit', function () {
-        // Without limit:
-        // - Malicious input: 1000+ iterations, seconds of CPU time
-        // - DoS attack possible with relatively small payloads
-        //
-        // With limit (maxIterations = 3):
-        // - Malicious input: 3 iterations max, milliseconds of CPU time
-        // - DoS attack prevented, performance predictable
-
-        $maxIterations = 3;
-        $worstCaseOps = $maxIterations * 2; // DOMParser + textContent per iteration
-        expect($worstCaseOps)->toBeLessThan(10); // Very low computational cost
-    });
-
-    it('verifies iteration counter increments correctly', function () {
-        // The implementation should:
-        // 1. Initialize: let iterations = 0;
-        // 2. Check: while (... && iterations < maxIterations)
-        // 3. Increment: iterations++;
-        //
-        // This ensures the counter actually prevents infinite loops
-
-        $initialValue = 0;
-        $increment = 1;
-        $maxValue = 3;
-
-        expect($initialValue)->toBe(0);
-        expect($increment)->toBe(1);
-        expect($maxValue)->toBeGreaterThan($initialValue);
-    });
-
-    it('confirms fix addresses the security advisory correctly', function () {
-        // Security advisory states:
-        // "decodeHtml() function uses a loop that could be exploited with
-        //  deeply nested HTML entities, potentially causing performance issues or DoS"
-        //
-        // Fix applied:
-        // 1. Add maxIterations constant (value: 3)
-        // 2. Add iterations counter
-        // 3. Update while condition to include iteration check
-        // 4. Increment counter in loop body
-        //
-        // This directly addresses the vulnerability
-
-        $vulnerabilityFixed = true;
-        expect($vulnerabilityFixed)->toBeTrue();
+            expect($contents)
+                ->toContain('document.createTextNode')
+                ->toContain('mark.textContent')
+                ->not->toContain('innerHTML')
+                ->not->toContain('x-html');
+        }
     });
 });
diff --git a/tests/Unit/ProxyConfigRecoveryTest.php b/tests/Unit/ProxyConfigRecoveryTest.php
index 682407bdf..0d6a04aa5 100644
--- a/tests/Unit/ProxyConfigRecoveryTest.php
+++ b/tests/Unit/ProxyConfigRecoveryTest.php
@@ -1,6 +1,7 @@
 <?php
 
 use App\Actions\Proxy\GetProxyConfiguration;
+use Illuminate\Log\LogManager;
 use Illuminate\Support\Facades\Cache;
 use Illuminate\Support\Facades\Log;
 use Spatie\SchemalessAttributes\SchemalessAttributes;
@@ -83,7 +84,7 @@ function mockServerWithDbConfig(?string $savedConfig, string $proxyType = 'TRAEF
 });
 
 it('logs warning when regenerating defaults', function () {
-    Log::swap(new \Illuminate\Log\LogManager(app()));
+    Log::swap(new LogManager(app()));
     Log::spy();
 
     // No DB config, no disk config — will try to regenerate
@@ -94,7 +95,7 @@ function mockServerWithDbConfig(?string $savedConfig, string $proxyType = 'TRAEF
     // the force regenerate path instead
     try {
         GetProxyConfiguration::run($server, forceRegenerate: true);
-    } catch (\Throwable $e) {
+    } catch (Throwable $e) {
         // generateDefaultProxyConfiguration may fail without full server setup
     }
 
@@ -115,7 +116,7 @@ function mockServerWithDbConfig(?string $savedConfig, string $proxyType = 'TRAEF
 });
 
 it('rejects stored Traefik config when proxy type is CADDY', function () {
-    Log::swap(new \Illuminate\Log\LogManager(app()));
+    Log::swap(new LogManager(app()));
     Log::spy();
 
     $traefikConfig = "services:\n  traefik:\n    image: traefik:v3.6\n";
@@ -126,7 +127,7 @@ function mockServerWithDbConfig(?string $savedConfig, string $proxyType = 'TRAEF
     // Both will fail in test env, but the warning log proves mismatch was detected.
     try {
         GetProxyConfiguration::run($server);
-    } catch (\Throwable $e) {
+    } catch (Throwable $e) {
         // Expected — regeneration requires SSH/full server setup
     }
 
@@ -136,7 +137,7 @@ function mockServerWithDbConfig(?string $savedConfig, string $proxyType = 'TRAEF
 });
 
 it('rejects stored Caddy config when proxy type is TRAEFIK', function () {
-    Log::swap(new \Illuminate\Log\LogManager(app()));
+    Log::swap(new LogManager(app()));
     Log::spy();
 
     $caddyConfig = "services:\n  caddy:\n    image: lucaslorentz/caddy-docker-proxy:2.8-alpine\n";
@@ -144,7 +145,7 @@ function mockServerWithDbConfig(?string $savedConfig, string $proxyType = 'TRAEF
 
     try {
         GetProxyConfiguration::run($server);
-    } catch (\Throwable $e) {
+    } catch (Throwable $e) {
         // Expected — regeneration requires SSH/full server setup
     }
 
diff --git a/tests/Unit/ServerUsernamePatternTest.php b/tests/Unit/ServerUsernamePatternTest.php
new file mode 100644
index 000000000..dab3f05a8
--- /dev/null
+++ b/tests/Unit/ServerUsernamePatternTest.php
@@ -0,0 +1,19 @@
+<?php
+
+use App\Models\Server;
+use App\Support\ValidationPatterns;
+
+it('provides shared validation rules for SSH usernames', function () {
+    expect(ValidationPatterns::SERVER_USERNAME_PATTERN)->toBe('/^[a-zA-Z0-9._-]+$/');
+    expect(ValidationPatterns::serverUsernameRules())->toContain('regex:'.ValidationPatterns::SERVER_USERNAME_PATTERN);
+
+    expect(preg_match(ValidationPatterns::SERVER_USERNAME_PATTERN, 'deploy.user'))->toBe(1);
+    expect(preg_match(ValidationPatterns::SERVER_USERNAME_PATTERN, 'deploy$user'))->toBe(0);
+});
+
+it('preserves dots when sanitizing server SSH usernames', function () {
+    $server = new Server;
+    $server->user = 'deploy.user';
+
+    expect($server->user)->toBe('deploy.user');
+});
diff --git a/tests/Unit/SshRetryMechanismTest.php b/tests/Unit/SshRetryMechanismTest.php
index 23e1b867f..62b25b9fc 100644
--- a/tests/Unit/SshRetryMechanismTest.php
+++ b/tests/Unit/SshRetryMechanismTest.php
@@ -10,12 +10,12 @@ class SshRetryMechanismTest extends TestCase
 {
     public function test_ssh_retry_handler_exists()
     {
-        $this->assertTrue(class_exists(\App\Helpers\SshRetryHandler::class));
+        $this->assertTrue(class_exists(SshRetryHandler::class));
     }
 
     public function test_ssh_retryable_trait_exists()
     {
-        $this->assertTrue(trait_exists(\App\Traits\SshRetryable::class));
+        $this->assertTrue(trait_exists(SshRetryable::class));
     }
 
     public function test_retry_on_ssh_connection_errors()
@@ -50,6 +50,24 @@ public function test_is_retryable_ssh_error($error)
         }
     }
 
+    public function test_generic_ssh_exit_255_error_is_retryable()
+    {
+        $handler = new class
+        {
+            use SshRetryable;
+
+            // Make methods public for testing
+            public function test_is_retryable_ssh_error($error)
+            {
+                return $this->isRetryableSshError($error);
+            }
+        };
+
+        $this->assertTrue(
+            $handler->test_is_retryable_ssh_error('SSH command failed with exit code: 255')
+        );
+    }
+
     public function test_non_ssh_errors_are_not_retryable()
     {
         $handler = new class
@@ -141,6 +159,32 @@ function () use (&$attemptCount) {
         $this->assertEquals(3, $attemptCount);
     }
 
+    public function test_retry_succeeds_after_generic_ssh_exit_255_failure()
+    {
+        $attemptCount = 0;
+
+        config([
+            'constants.ssh.max_retries' => 3,
+            'constants.ssh.retry_base_delay' => 0,
+        ]);
+
+        $result = SshRetryHandler::retry(
+            function () use (&$attemptCount) {
+                $attemptCount++;
+                if ($attemptCount === 1) {
+                    throw new \RuntimeException('SSH command failed with exit code: 255');
+                }
+
+                return 'success';
+            },
+            ['test' => 'generic_ssh_255_retry_test'],
+            true
+        );
+
+        $this->assertEquals('success', $result);
+        $this->assertEquals(2, $attemptCount);
+    }
+
     public function test_retry_fails_after_max_attempts()
     {
         $attemptCount = 0;
diff --git a/tests/Unit/UpgradePostgresScriptTest.php b/tests/Unit/UpgradePostgresScriptTest.php
new file mode 100644
index 000000000..49a6b881f
--- /dev/null
+++ b/tests/Unit/UpgradePostgresScriptTest.php
@@ -0,0 +1,93 @@
+<?php
+
+function assertBashSyntaxIsValid(string $path): void
+{
+    $process = proc_open(
+        ['bash', '-n', getcwd().'/'.$path],
+        [
+            1 => ['pipe', 'w'],
+            2 => ['pipe', 'w'],
+        ],
+        $pipes,
+        getcwd()
+    );
+
+    expect($process)->toBeResource();
+
+    $stdout = stream_get_contents($pipes[1]);
+    $stderr = stream_get_contents($pipes[2]);
+    fclose($pipes[1]);
+    fclose($pipes[2]);
+
+    $exitCode = proc_close($process);
+
+    expect($exitCode, trim($stdout."\n".$stderr))->toBe(0);
+}
+
+it('ships postgres upgrade scripts with valid bash syntax', function () {
+    assertBashSyntaxIsValid('scripts/upgrade-postgres.sh');
+    assertBashSyntaxIsValid('other/nightly/upgrade-postgres.sh');
+});
+
+it('downloads postgres upgrade script during install and upgrade without auto-running it', function (string $path) {
+    $script = file_get_contents(getcwd().'/'.$path);
+
+    expect($script)
+        ->toContain('upgrade-postgres.sh')
+        ->toContain('curl -fsSL -L $CDN/upgrade-postgres.sh -o /data/coolify/source/upgrade-postgres.sh')
+        ->toContain('chmod +x')
+        ->not->toContain('bash /data/coolify/source/upgrade-postgres.sh');
+})->with([
+    'stable install' => 'scripts/install.sh',
+    'nightly install' => 'other/nightly/install.sh',
+    'stable upgrade' => 'scripts/upgrade.sh',
+    'nightly upgrade' => 'other/nightly/upgrade.sh',
+]);
+
+it('keeps postgres upgrade compose override in future upgrade compose commands', function (string $path) {
+    $script = file_get_contents(getcwd().'/'.$path);
+
+    expect($script)
+        ->toContain('docker-compose.postgres-upgrade.yml')
+        ->toContain('Including PostgreSQL upgrade compose override in image extraction')
+        ->toContain('Using PostgreSQL upgrade compose override');
+})->with([
+    'stable upgrade' => 'scripts/upgrade.sh',
+    'nightly upgrade' => 'other/nightly/upgrade.sh',
+]);
+
+it('uses postgres 18 compatible mount path in generated override and restore container', function () {
+    $script = file_get_contents(getcwd().'/scripts/upgrade-postgres.sh');
+
+    expect($script)
+        ->toContain("printf '%s' '/var/lib/postgresql'")
+        ->toContain("printf '%s' '/var/lib/postgresql/data'")
+        ->toContain('- coolify-db:${mount_path}')
+        ->toContain('-v "${TARGET_VOLUME}:${TARGET_MOUNT_PATH}"');
+});
+
+it('persists rollback metadata and exposes a rollback command', function () {
+    $script = file_get_contents(getcwd().'/scripts/upgrade-postgres.sh');
+
+    expect($script)
+        ->toContain('ROLLBACK_FILE="${SOURCE_DIR}/postgres-upgrade-rollback.env"')
+        ->toContain('$0 rollback')
+        ->toContain('write_rollback_file')
+        ->toContain('PREVIOUS_VOLUME=')
+        ->toContain('PREVIOUS_IMAGE=')
+        ->toContain('PREVIOUS_MOUNT_PATH=')
+        ->toContain('rollback_postgres()')
+        ->toContain('Rollback completed successfully.');
+});
+
+it('detects the active postgres volume instead of assuming coolify-db', function () {
+    $script = file_get_contents(getcwd().'/scripts/upgrade-postgres.sh');
+
+    expect($script)
+        ->toContain('current_postgres_mount_name()')
+        ->toContain('current_postgres_mount_path()')
+        ->toContain('current_postgres_image()')
+        ->toContain('Current active volume: ${PREVIOUS_VOLUME}')
+        ->toContain("Previous volume '")
+        ->toContain('will be kept for rollback');
+});