diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c1bbe9c44..9d3fe3641 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -287,10 +287,15 @@ jobs:
           image_refs=()
 
           tag_and_push() {
-            local src="$1" img_name tag dst
+            local src="$1" img_name tag dst variant=""
             img_name="${src%%:*}"
+            # Client variants share a repository, so keep their tag suffixes.
+            case "$src" in
+              *-rootless-ubi-amd64) variant="-rootless-ubi" ;;
+              *-rootless-amd64) variant="-rootless" ;;
+            esac
             for tag in $(resolve_tags); do
-              dst="${img_name}:${tag}"
+              dst="${img_name}:${tag}${variant}"
               echo "Tagging ${src} -> ${dst}"
               docker tag "$src" "$dst"
               docker push "$dst"
diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index c5d260376..778ccb892 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -289,6 +289,43 @@ dockers_v2:
        "org.opencontainers.image.revision": "{{.FullCommit}}"
        "org.opencontainers.image.source": "{{.GitURL}}"
        "maintainer": "dev@netbird.io"
+   - id: netbird-rootless-ubi
+     disable: "{{ .Env.SKIP_DOCKER_PUSH }}"
+     ids:
+       - netbird
+     images:
+       - netbirdio/netbird
+       - ghcr.io/netbirdio/netbird
+     tags:
+       - "{{ .Version }}-rootless-ubi"
+       - "{{ if eq .Env.SKIP_PUBLISH \"false\" }}rootless-ubi-latest{{ end }}"
+     dockerfile: client/Dockerfile-rootless.ubi
+     extra_files:
+       - client/netbird-entrypoint.sh
+     platforms:
+       - linux/amd64
+       - linux/arm64
+     build_args:
+       VERSION: "{{ .Version }}"
+       RELEASE: "{{ .Timestamp }}"
+     hooks:
+       pre:
+         - cmd: 'sh client/collect-licenses.sh "{{ .ContextDir }}/licenses" amd64 arm64'
+           env:
+             - GOOS=linux
+             - CGO_ENABLED=0
+     labels:
+       "org.opencontainers.image.created": "{{.Date}}"
+       "org.opencontainers.image.version": "{{.Version}}"
+       "org.opencontainers.image.revision": "{{.FullCommit}}"
+       "org.opencontainers.image.source": "{{.GitURL}}"
+     annotations:
+       "org.opencontainers.image.created": "{{.Date}}"
+       "org.opencontainers.image.title": "{{.ProjectName}}"
+       "org.opencontainers.image.version": "{{.Version}}"
+       "org.opencontainers.image.revision": "{{.FullCommit}}"
+       "org.opencontainers.image.source": "{{.GitURL}}"
+       "maintainer": "dev@netbird.io"
    - id: relay
      disable: "{{ .Env.SKIP_DOCKER_PUSH }}"
      ids:
diff --git a/client/Dockerfile-rootless.ubi b/client/Dockerfile-rootless.ubi
new file mode 100644
index 000000000..4701728c1
--- /dev/null
+++ b/client/Dockerfile-rootless.ubi
@@ -0,0 +1,45 @@
+FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:7fbeae18dc9476399f565e68255f602a3374ea8614ba3d14843565131a13ff93
+
+ARG TARGETPLATFORM
+ARG NETBIRD_BINARY=$TARGETPLATFORM/netbird
+ARG VERSION=dev
+ARG RELEASE=1
+
+LABEL name="netbird-rootless" \
+      maintainer="NetBird <dev@netbird.io>" \
+      vendor="NetBird GmbH" \
+      version="${VERSION}" \
+      release="${RELEASE}" \
+      summary="NetBird Rootless Client" \
+      description="NetBird connects devices through an encrypted overlay using userspace networking without a TUN device or network administration capabilities."
+
+RUN microdnf install -y bash ca-certificates && microdnf clean all
+
+COPY --chmod=0555 client/netbird-entrypoint.sh /usr/local/bin/netbird-entrypoint.sh
+COPY --chmod=0555 ${NETBIRD_BINARY} /usr/local/bin/netbird
+COPY licenses/ /licenses/
+# Only application storage is group-writable for arbitrary non-root UIDs.
+# Runtime-created credentials keep the client's restrictive file modes.
+RUN mkdir -p /var/lib/netbird && \
+    chown 1000:0 /var/lib/netbird && \
+    chmod 0770 /var/lib/netbird && \
+    chmod -R a+rX /licenses
+
+WORKDIR /var/lib/netbird
+USER 1000:0
+
+ENV \
+    HOME="/var/lib/netbird" \
+    NETBIRD_BIN="/usr/local/bin/netbird" \
+    NB_USE_NETSTACK_MODE="true" \
+    NB_ENABLE_NETSTACK_LOCAL_FORWARDING="true" \
+    NB_CONFIG="/var/lib/netbird/config.json" \
+    NB_STATE_DIR="/var/lib/netbird" \
+    NB_DAEMON_ADDR="unix:///var/lib/netbird/netbird.sock" \
+    NB_LOG_FILE="console,/var/lib/netbird/client.log" \
+    NB_DISABLE_DNS="true" \
+    NB_ENABLE_CAPTURE="false" \
+    NB_ENTRYPOINT_SERVICE_TIMEOUT="30"
+
+STOPSIGNAL SIGTERM
+ENTRYPOINT ["/usr/local/bin/netbird-entrypoint.sh"]
diff --git a/client/android/client.go b/client/android/client.go
index 5bd0d1e10..e47a1c13d 100644
--- a/client/android/client.go
+++ b/client/android/client.go
@@ -9,6 +9,7 @@ import (
 	"slices"
 	"strings"
 	"sync"
+	"sync/atomic"
 	"time"
 
 	"golang.org/x/exp/maps"
@@ -90,6 +91,14 @@ type Client struct {
 	connectClient *internal.ConnectClient
 	config        *profilemanager.Config
 	cacheDir      string
+
+	// mdmSource holds the per-Client MDM policy source and its change
+	// detector as one unit. Set by SetMDMPolicyFetcher (called from the
+	// Kotlin side). Each Run passes the loader to the resolved Config so
+	// applyMDMPolicy picks up the active overlay. Nil means "MDM
+	// enforcement off for this Client".
+	mdmSource atomic.Pointer[mdmSource]
+
 	// Identifies the running profile for the SSO login hint; see profile_state.go.
 	cfgPath string
 
@@ -178,6 +187,7 @@ func (c *Client) Run(platformFiles PlatformFiles, urlOpener URLOpener, isAndroid
 	if err != nil {
 		return err
 	}
+	c.applyMDMOverlay(cfg)
 	c.recorder.UpdateManagementAddress(cfg.ManagementURL.String())
 	c.recorder.UpdateRosenpass(cfg.RosenpassEnabled, cfg.RosenpassPermissive)
 
@@ -229,6 +239,7 @@ func (c *Client) RunWithoutLogin(platformFiles PlatformFiles, dns *DNSList, dnsR
 	if err != nil {
 		return err
 	}
+	c.applyMDMOverlay(cfg)
 	c.recorder.UpdateManagementAddress(cfg.ManagementURL.String())
 	c.recorder.UpdateRosenpass(cfg.RosenpassEnabled, cfg.RosenpassPermissive)
 
@@ -327,6 +338,7 @@ func (c *Client) DebugBundle(platformFiles PlatformFiles, anonymize bool, anonym
 		if err != nil {
 			return "", fmt.Errorf("load config: %w", err)
 		}
+		c.applyMDMOverlay(cfg)
 		cacheDir = platformFiles.CacheDir()
 	}
 
diff --git a/client/android/client_mdm.go b/client/android/client_mdm.go
new file mode 100644
index 000000000..d043b85d3
--- /dev/null
+++ b/client/android/client_mdm.go
@@ -0,0 +1,52 @@
+//go:build android
+
+package android
+
+import (
+	"github.com/netbirdio/netbird/client/internal/profilemanager"
+	"github.com/netbirdio/netbird/client/mdm"
+)
+
+type mdmSource struct {
+	loader   *mdm.Loader
+	detector *mdm.ChangeDetector
+}
+
+// SetMDMPolicyFetcher registers the native-provided MDM policy fetcher on
+// this Client; passing nil disables MDM enforcement.
+func (c *Client) SetMDMPolicyFetcher(p PolicyFetcher) {
+	loader := loaderFor(p)
+	c.mdmSource.Store(&mdmSource{loader: loader, detector: mdm.NewChangeDetector(loader)})
+}
+
+// HasMDMPolicyChanged re-reads the managed configuration and reports whether
+// it changed since the last observation; call it from the native OS-change
+// notification and restart the engine only on true.
+func (c *Client) HasMDMPolicyChanged() bool {
+	src := c.mdmSource.Load()
+	if src == nil {
+		return false
+	}
+	return src.detector.Changed()
+}
+
+// GetRestrictionsJSON returns the UI enforcement snapshot derived from the
+// active MDM policy, in the JSON shape shared with the desktop frontend.
+func (c *Client) GetRestrictionsJSON() (string, error) {
+	return mdm.BuildRestrictions(c.mdmLoader().Load()).JSON()
+}
+
+func (c *Client) applyMDMOverlay(cfg *profilemanager.Config) {
+	loader := c.mdmLoader()
+	if cfg == nil || loader == nil {
+		return
+	}
+	cfg.ApplyMDMPolicy(loader.Load())
+}
+
+func (c *Client) mdmLoader() *mdm.Loader {
+	if src := c.mdmSource.Load(); src != nil {
+		return src.loader
+	}
+	return nil
+}
diff --git a/client/android/login.go b/client/android/login.go
index 3742e01a5..155c6eadd 100644
--- a/client/android/login.go
+++ b/client/android/login.go
@@ -8,6 +8,7 @@ import (
 
 	"github.com/netbirdio/netbird/client/internal/auth"
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
+	"github.com/netbirdio/netbird/client/mdm"
 	"github.com/netbirdio/netbird/client/mobile"
 	"github.com/netbirdio/netbird/client/system"
 )
@@ -46,16 +47,24 @@ type Auth struct {
 // an earlier call is orphaned on the server. It also breaks a client that enrols and then runs from
 // the persisted config, because the identity it registered is not the one it runs with — the
 // management stream rejects it with "no peer auth method provided".
-func NewAuth(cfgPath string, mgmURL string) (*Auth, error) {
-	inputCfg := profilemanager.ConfigInput{
-		ConfigPath:    cfgPath,
-		ManagementURL: mgmURL,
+//
+// Auth is constructed under the active MDM policy: the policy is overlaid on
+// the resolved config so the login runs against the enforced values, while
+// the persisted config keeps the caller-supplied ones; a caller-supplied
+// management URL is ignored while MDM manages that key. A nil fetcher
+// disables MDM enforcement.
+func NewAuth(cfgPath string, mgmURL string, fetcher PolicyFetcher) (*Auth, error) {
+	policy := loaderFor(fetcher).Load()
+	inputCfg := profilemanager.ConfigInput{ConfigPath: cfgPath}
+	if _, managed := policy.GetString(mdm.KeyManagementURL); !managed {
+		inputCfg.ManagementURL = mgmURL
 	}
 
 	cfg, err := profilemanager.UpdateOrCreateConfig(inputCfg)
 	if err != nil {
 		return nil, err
 	}
+	cfg.ApplyMDMPolicy(policy)
 
 	return &Auth{
 		ctx:     context.Background(),
@@ -75,9 +84,7 @@ func NewAuthWithConfig(ctx context.Context, config *profilemanager.Config, cfgPa
 	}
 }
 
-// SaveConfigIfSSOSupported test the connectivity with the management server by retrieving the server device flow info.
-// If it returns a flow info than save the configuration and return true. If it gets a codes.NotFound, it means that SSO
-// is not supported and returns false without saving the configuration. For other errors return false.
+// SaveConfigIfSSOSupported reports whether the management server supports SSO; the config is already persisted by NewAuth.
 func (a *Auth) SaveConfigIfSSOSupported(listener SSOListener) {
 	go func() {
 		sso, err := a.saveConfigIfSSOSupported()
@@ -101,15 +108,10 @@ func (a *Auth) saveConfigIfSSOSupported() (bool, error) {
 		return false, fmt.Errorf("failed to check SSO support: %v", err)
 	}
 
-	if !supportsSSO {
-		return false, nil
-	}
-
-	err = profilemanager.WriteOutConfig(a.cfgPath, a.config)
-	return true, err
+	return supportsSSO, nil
 }
 
-// LoginWithSetupKeyAndSaveConfig test the connectivity with the management server with the setup key.
+// LoginWithSetupKeyAndSaveConfig registers the peer with the setup key; the config is already persisted by NewAuth.
 func (a *Auth) LoginWithSetupKeyAndSaveConfig(resultListener ErrListener, setupKey string, deviceName string) {
 	go func() {
 		err := a.loginWithSetupKeyAndSaveConfig(setupKey, deviceName)
@@ -134,8 +136,7 @@ func (a *Auth) loginWithSetupKeyAndSaveConfig(setupKey string, deviceName string
 	if err != nil {
 		return fmt.Errorf("login failed: %v", err)
 	}
-
-	return profilemanager.WriteOutConfig(a.cfgPath, a.config)
+	return nil
 }
 
 // Login try register the client on the server
diff --git a/client/android/login_test.go b/client/android/login_test.go
index b04790f6b..130a846fc 100644
--- a/client/android/login_test.go
+++ b/client/android/login_test.go
@@ -16,7 +16,7 @@ import (
 func TestNewAuth_ReusesPersistedIdentity(t *testing.T) {
 	cfgPath := filepath.Join(t.TempDir(), "config.json")
 
-	first, err := NewAuth(cfgPath, "https://api.example.com:443")
+	first, err := NewAuth(cfgPath, "https://api.example.com:443", nil)
 	if err != nil {
 		t.Fatalf("first NewAuth: %v", err)
 	}
@@ -24,7 +24,7 @@ func TestNewAuth_ReusesPersistedIdentity(t *testing.T) {
 		t.Fatal("first NewAuth produced no private key")
 	}
 
-	second, err := NewAuth(cfgPath, "https://api.example.com:443")
+	second, err := NewAuth(cfgPath, "https://api.example.com:443", nil)
 	if err != nil {
 		t.Fatalf("second NewAuth: %v", err)
 	}
@@ -38,7 +38,7 @@ func TestNewAuth_ReusesPersistedIdentity(t *testing.T) {
 func TestNewAuth_CreatesConfigWhenAbsent(t *testing.T) {
 	cfgPath := filepath.Join(t.TempDir(), "config.json")
 
-	auth, err := NewAuth(cfgPath, "https://api.example.com:443")
+	auth, err := NewAuth(cfgPath, "https://api.example.com:443", nil)
 	if err != nil {
 		t.Fatalf("NewAuth: %v", err)
 	}
diff --git a/client/android/mdm.go b/client/android/mdm.go
new file mode 100644
index 000000000..617d8f7cb
--- /dev/null
+++ b/client/android/mdm.go
@@ -0,0 +1,19 @@
+package android
+
+import (
+	"github.com/netbirdio/netbird/client/mdm"
+)
+
+// PolicyFetcher is implemented by the native layer to return the current
+// managed configuration as a JSON-encoded object string; "" means no MDM
+// source is present.
+type PolicyFetcher interface {
+	FetchJSON() string
+}
+
+func loaderFor(p PolicyFetcher) *mdm.Loader {
+	if p == nil {
+		return mdm.NewJSONLoader(nil)
+	}
+	return mdm.NewJSONLoader(p.FetchJSON)
+}
diff --git a/client/android/preferences.go b/client/android/preferences.go
index d90365518..5ce31026c 100644
--- a/client/android/preferences.go
+++ b/client/android/preferences.go
@@ -1,12 +1,16 @@
 package android
 
 import (
+	"sync/atomic"
+
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
+	"github.com/netbirdio/netbird/client/mdm"
 )
 
 // Preferences exports a subset of the internal config for gomobile
 type Preferences struct {
 	configInput profilemanager.ConfigInput
+	mdmLoader   atomic.Pointer[mdm.Loader]
 }
 
 // NewPreferences creates a new Preferences instance
@@ -14,11 +18,30 @@ func NewPreferences(configPath string) *Preferences {
 	ci := profilemanager.ConfigInput{
 		ConfigPath: configPath,
 	}
-	return &Preferences{ci}
+	return &Preferences{configInput: ci}
+}
+
+// SetMDMPolicyFetcher registers the native-provided MDM policy fetcher on
+// this Preferences instance; passing nil disables MDM enforcement.
+func (p *Preferences) SetMDMPolicyFetcher(f PolicyFetcher) {
+	p.mdmLoader.Store(loaderFor(f))
+}
+
+// GetRestrictionsJSON returns the UI enforcement snapshot derived from the
+// active MDM policy, in the JSON shape shared with the desktop frontend.
+func (p *Preferences) GetRestrictionsJSON() (string, error) {
+	return mdm.BuildRestrictions(p.policy()).JSON()
+}
+
+func (p *Preferences) policy() *mdm.Policy {
+	return p.mdmLoader.Load().Load()
 }
 
 // GetManagementURL reads URL from config file
 func (p *Preferences) GetManagementURL() (string, error) {
+	if v, ok := p.policy().GetString(mdm.KeyManagementURL); ok {
+		return mdm.CanonicalURL(v), nil
+	}
 	if p.configInput.ManagementURL != "" {
 		return p.configInput.ManagementURL, nil
 	}
@@ -27,7 +50,7 @@ func (p *Preferences) GetManagementURL() (string, error) {
 	if err != nil {
 		return "", err
 	}
-	return cfg.ManagementURL.String(), err
+	return cfg.ManagementURL.String(), nil
 }
 
 // SetManagementURL stores the given URL and waits for commit
@@ -53,17 +76,21 @@ func (p *Preferences) SetAdminURL(url string) {
 	p.configInput.AdminURL = url
 }
 
-// GetPreSharedKey reads pre-shared key from config file
-func (p *Preferences) GetPreSharedKey() (string, error) {
+// HasPreSharedKey reports whether a pre-shared key is staged, persisted, or
+// enforced by MDM; the key itself is never handed to the native layer.
+func (p *Preferences) HasPreSharedKey() (bool, error) {
+	if _, ok := p.policy().GetString(mdm.KeyPreSharedKey); ok {
+		return true, nil
+	}
 	if p.configInput.PreSharedKey != nil {
-		return *p.configInput.PreSharedKey, nil
+		return *p.configInput.PreSharedKey != "", nil
 	}
 
 	cfg, err := profilemanager.ReadConfig(p.configInput.ConfigPath)
 	if err != nil {
-		return "", err
+		return false, err
 	}
-	return cfg.PreSharedKey, err
+	return cfg.PreSharedKey != "", nil
 }
 
 // SetPreSharedKey stores the given key and waits for commit
@@ -78,6 +105,9 @@ func (p *Preferences) SetRosenpassEnabled(enabled bool) {
 
 // GetRosenpassEnabled reads Rosenpass enabled status from config file
 func (p *Preferences) GetRosenpassEnabled() (bool, error) {
+	if v, ok := p.policy().GetBool(mdm.KeyRosenpassEnabled); ok {
+		return v, nil
+	}
 	if p.configInput.RosenpassEnabled != nil {
 		return *p.configInput.RosenpassEnabled, nil
 	}
@@ -96,6 +126,9 @@ func (p *Preferences) SetRosenpassPermissive(permissive bool) {
 
 // GetRosenpassPermissive reads Rosenpass permissive setting from config file
 func (p *Preferences) GetRosenpassPermissive() (bool, error) {
+	if v, ok := p.policy().GetBool(mdm.KeyRosenpassPermissive); ok {
+		return v, nil
+	}
 	if p.configInput.RosenpassPermissive != nil {
 		return *p.configInput.RosenpassPermissive, nil
 	}
@@ -109,6 +142,9 @@ func (p *Preferences) GetRosenpassPermissive() (bool, error) {
 
 // GetDisableClientRoutes reads disable client routes setting from config file
 func (p *Preferences) GetDisableClientRoutes() (bool, error) {
+	if v, ok := p.policy().GetBool(mdm.KeyDisableClientRoutes); ok {
+		return v, nil
+	}
 	if p.configInput.DisableClientRoutes != nil {
 		return *p.configInput.DisableClientRoutes, nil
 	}
@@ -127,6 +163,9 @@ func (p *Preferences) SetDisableClientRoutes(disable bool) {
 
 // GetDisableServerRoutes reads disable server routes setting from config file
 func (p *Preferences) GetDisableServerRoutes() (bool, error) {
+	if v, ok := p.policy().GetBool(mdm.KeyDisableServerRoutes); ok {
+		return v, nil
+	}
 	if p.configInput.DisableServerRoutes != nil {
 		return *p.configInput.DisableServerRoutes, nil
 	}
@@ -181,6 +220,9 @@ func (p *Preferences) SetDisableFirewall(disable bool) {
 
 // GetServerSSHAllowed reads server SSH allowed setting from config file
 func (p *Preferences) GetServerSSHAllowed() (bool, error) {
+	if v, ok := p.policy().GetBool(mdm.KeyAllowServerSSH); ok {
+		return v, nil
+	}
 	if p.configInput.ServerSSHAllowed != nil {
 		return *p.configInput.ServerSSHAllowed, nil
 	}
@@ -291,6 +333,9 @@ func (p *Preferences) SetEnableSSHRemotePortForwarding(enabled bool) {
 
 // GetBlockInbound reads block inbound setting from config file
 func (p *Preferences) GetBlockInbound() (bool, error) {
+	if v, ok := p.policy().GetBool(mdm.KeyBlockInbound); ok {
+		return v, nil
+	}
 	if p.configInput.BlockInbound != nil {
 		return *p.configInput.BlockInbound, nil
 	}
@@ -327,7 +372,8 @@ func (p *Preferences) SetDisableIPv6(disable bool) {
 
 // GetRemoteJobsAllowed reads the remote jobs opt-in from config file
 func (p *Preferences) GetRemoteJobsAllowed() (bool, error) {
-	if p.configInput.RemoteJobsAllowed != nil {
+	policy := p.policy()
+	if !policy.HasKey(mdm.KeyRemoteJobsAllowed) && p.configInput.RemoteJobsAllowed != nil {
 		return *p.configInput.RemoteJobsAllowed, nil
 	}
 
@@ -335,10 +381,11 @@ func (p *Preferences) GetRemoteJobsAllowed() (bool, error) {
 	if err != nil {
 		return false, err
 	}
+	cfg.ApplyMDMPolicy(policy)
 	if cfg.RemoteJobsAllowed == nil {
 		return false, nil
 	}
-	return *cfg.RemoteJobsAllowed, err
+	return *cfg.RemoteJobsAllowed, nil
 }
 
 // SetRemoteJobsAllowed stores the given value and waits for commit
@@ -348,6 +395,9 @@ func (p *Preferences) SetRemoteJobsAllowed(allowed bool) {
 
 // Commit writes out the changes to the config file
 func (p *Preferences) Commit() error {
+	if err := profilemanager.CheckMDMConflicts(p.configInput, p.policy()); err != nil {
+		return err
+	}
 	_, err := profilemanager.UpdateOrCreateConfig(p.configInput)
 	return err
 }
diff --git a/client/android/preferences_test.go b/client/android/preferences_test.go
index 2bbccef86..d9f5b1918 100644
--- a/client/android/preferences_test.go
+++ b/client/android/preferences_test.go
@@ -28,14 +28,13 @@ func TestPreferences_DefaultValues(t *testing.T) {
 		t.Errorf("invalid default management url: %s", defaultVar)
 	}
 
-	var preSharedKey string
-	preSharedKey, err = p.GetPreSharedKey()
+	hasPSK, err := p.HasPreSharedKey()
 	if err != nil {
-		t.Fatalf("failed to read default preshared key: %s", err)
+		t.Fatalf("failed to read default preshared key presence: %s", err)
 	}
 
-	if preSharedKey != "" {
-		t.Errorf("invalid preshared key: %s", preSharedKey)
+	if hasPSK {
+		t.Errorf("unexpected preshared key presence on fresh config")
 	}
 }
 
@@ -65,13 +64,13 @@ func TestPreferences_ReadUncommitedValues(t *testing.T) {
 	}
 
 	p.SetPreSharedKey(exampleString)
-	resp, err = p.GetPreSharedKey()
+	hasPSK, err := p.HasPreSharedKey()
 	if err != nil {
-		t.Fatalf("failed to read preshared key: %s", err)
+		t.Fatalf("failed to read preshared key presence: %s", err)
 	}
 
-	if resp != exampleString {
-		t.Errorf("unexpected preshared key: %s", resp)
+	if !hasPSK {
+		t.Errorf("expected preshared key presence after staging one")
 	}
 }
 
@@ -109,12 +108,12 @@ func TestPreferences_Commit(t *testing.T) {
 		t.Errorf("unexpected management url: %s", resp)
 	}
 
-	resp, err = p.GetPreSharedKey()
+	hasPSK, err := p.HasPreSharedKey()
 	if err != nil {
-		t.Fatalf("failed to read preshared key: %s", err)
+		t.Fatalf("failed to read preshared key presence: %s", err)
 	}
 
-	if resp != examplePresharedKey {
-		t.Errorf("unexpected preshared key: %s", resp)
+	if !hasPSK {
+		t.Errorf("expected preshared key presence after commit")
 	}
 }
diff --git a/client/android/profile_manager.go b/client/android/profile_manager.go
index 557c837a7..4bc60c453 100644
--- a/client/android/profile_manager.go
+++ b/client/android/profile_manager.go
@@ -54,6 +54,12 @@ func NewProfileManager(configDir string) *ProfileManager {
 	return &ProfileManager{impl: mobile.NewProfileManager(configDir, androidUsername)}
 }
 
+// SetMDMPolicyFetcher registers the native-provided MDM policy fetcher on
+// this ProfileManager; passing nil disables MDM enforcement.
+func (pm *ProfileManager) SetMDMPolicyFetcher(f PolicyFetcher) {
+	pm.impl.SetMDMLoader(loaderFor(f))
+}
+
 // ListProfiles returns all available profiles, including the default profile,
 // with their active status set.
 func (pm *ProfileManager) ListProfiles() (*ProfileArray, error) {
diff --git a/client/cmd/login.go b/client/cmd/login.go
index 4e08334eb..11867be09 100644
--- a/client/cmd/login.go
+++ b/client/cmd/login.go
@@ -15,6 +15,7 @@ import (
 	"github.com/netbirdio/netbird/client/internal"
 	"github.com/netbirdio/netbird/client/internal/auth"
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
+	"github.com/netbirdio/netbird/client/mdm"
 	nbnet "github.com/netbirdio/netbird/client/net"
 	"github.com/netbirdio/netbird/client/proto"
 	"github.com/netbirdio/netbird/client/server"
@@ -330,6 +331,11 @@ func doForegroundLogin(ctx context.Context, cmd *cobra.Command, setupKey string,
 	if err != nil {
 		return fmt.Errorf("read config file %s: %v", configFilePath, err)
 	}
+	// CLI standalone login: profilemanager no longer auto-applies MDM,
+	// so layer in the OS-native policy here. Desktop builds construct
+	// a Loader with no fetcher — the build-tagged loadPlatform reads
+	// the registry/plist directly.
+	config.ApplyMDMPolicy(mdm.NewLoader(nil).Load())
 
 	// Mirror runInForegroundMode: recover residual state (DNS, firewall,
 	// ssh config, legacy routing) from a previous unclean shutdown and
diff --git a/client/cmd/up.go b/client/cmd/up.go
index 2e53224df..f5fac9749 100644
--- a/client/cmd/up.go
+++ b/client/cmd/up.go
@@ -21,6 +21,7 @@ import (
 	"github.com/netbirdio/netbird/client/internal"
 	"github.com/netbirdio/netbird/client/internal/peer"
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
+	"github.com/netbirdio/netbird/client/mdm"
 	nbnet "github.com/netbirdio/netbird/client/net"
 	"github.com/netbirdio/netbird/client/proto"
 	"github.com/netbirdio/netbird/client/server"
@@ -234,6 +235,10 @@ func runInForegroundMode(ctx context.Context, cmd *cobra.Command, activeProf *pr
 	if err != nil {
 		return fmt.Errorf("get config file: %v", err)
 	}
+	// CLI foreground path runs without the daemon Server: layer in the
+	// active MDM policy explicitly so a forced ManagementURL / PSK /
+	// other managed key actually takes effect on this run.
+	config.ApplyMDMPolicy(mdm.NewLoader(nil).Load())
 
 	_, _ = profilemanager.UpdateOldManagementURL(ctx, config, configFilePath)
 
diff --git a/client/collect-licenses.sh b/client/collect-licenses.sh
new file mode 100644
index 000000000..7dfabada9
--- /dev/null
+++ b/client/collect-licenses.sh
@@ -0,0 +1,77 @@
+#!/bin/sh
+set -eu
+
+if [ "$#" -lt 2 ]; then
+	printf '%s\n' "usage: $0 OUTPUT_DIRECTORY GOARCH..." >&2
+	exit 2
+fi
+
+repo_root=$(CDPATH= cd -- "$(dirname "$0")/.." && pwd)
+output_name=$(basename "$1")
+if [ -z "$output_name" ] || [ "$output_name" = "." ] ||
+	[ "$output_name" = ".." ] || [ "$output_name" = "/" ]; then
+	printf '%s\n' "OUTPUT_DIRECTORY must name a directory" >&2
+	exit 2
+fi
+output_parent=$(CDPATH= cd -- "$(dirname "$1")" && pwd)
+output="$output_parent/$output_name"
+shift
+modules=$(mktemp "${TMPDIR:-/tmp}/netbird-client-licenses.modules.XXXXXX")
+sorted_modules=$(mktemp "${TMPDIR:-/tmp}/netbird-client-licenses.sorted.XXXXXX")
+trap 'rm -f "$modules" "$sorted_modules"' EXIT HUP INT TERM
+
+if [ -e "$output" ] || [ -L "$output" ]; then
+	printf 'output directory already exists: %s\n' "$output" >&2
+	exit 1
+fi
+mkdir "$output"
+mkdir "$output/third_party"
+
+cp "$repo_root/LICENSE" "$output/BSD-3-Clause.txt"
+
+cd "$repo_root"
+for arch in "$@"; do
+	GOOS=${GOOS:-linux} GOARCH="$arch" CGO_ENABLED=${CGO_ENABLED:-0} \
+		go list -deps -f '{{with .Module}}{{if .Replace}}{{.Replace.Path}}{{"\t"}}{{.Replace.Version}}{{"\t"}}{{.Replace.Dir}}{{else}}{{.Path}}{{"\t"}}{{.Version}}{{"\t"}}{{.Dir}}{{end}}{{end}}' -tags load_wgnt_from_rsrc ./client >>"$modules"
+done
+LC_ALL=C sort -u "$modules" >"$sorted_modules"
+
+goroot=$(go env GOROOT)
+for term in LICENSE PATENTS; do
+	if [ ! -f "$goroot/$term" ]; then
+		printf 'missing Go standard-library term: %s\n' "$goroot/$term" >&2
+		exit 1
+	fi
+	cp "$goroot/$term" "$output/Go-$term"
+done
+
+while IFS='	' read -r module version module_dir; do
+	[ -n "$module" ] || continue
+	[ "$module" = "github.com/netbirdio/netbird" ] && continue
+
+	if [ -z "$version" ] || [ ! -d "$module_dir" ]; then
+		printf 'cannot collect terms for module %s at version %s\n' "$module" "$version" >&2
+		exit 1
+	fi
+
+	destination="$output/third_party/$module/$version"
+	mkdir -p "$destination"
+	printf 'module: %s\nversion: %s\n' "$module" "$version" >"$destination/MODULE"
+
+	found=false
+	for term in \
+		"$module_dir"/LICENSE* "$module_dir"/License* "$module_dir"/license* \
+		"$module_dir"/LICENCE* "$module_dir"/Licence* "$module_dir"/licence* \
+		"$module_dir"/COPYING* "$module_dir"/Copying* "$module_dir"/copying* \
+		"$module_dir"/NOTICE* "$module_dir"/Notice* "$module_dir"/notice* \
+		"$module_dir"/PATENTS* "$module_dir"/Patents* "$module_dir"/patents*; do
+		[ -f "$term" ] || continue
+		cp "$term" "$destination/"
+		found=true
+	done
+
+	if [ "$found" = false ]; then
+		printf 'no root license terms found for module %s at %s\n' "$module" "$module_dir" >&2
+		exit 1
+	fi
+done <"$sorted_modules"
diff --git a/client/embed/embed.go b/client/embed/embed.go
index 5a3d11f24..5a3d540ec 100644
--- a/client/embed/embed.go
+++ b/client/embed/embed.go
@@ -21,6 +21,7 @@ import (
 	"github.com/netbirdio/netbird/client/internal/auth"
 	"github.com/netbirdio/netbird/client/internal/peer"
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
+	"github.com/netbirdio/netbird/client/mdm"
 	nbssh "github.com/netbirdio/netbird/client/ssh"
 	"github.com/netbirdio/netbird/client/system"
 	"github.com/netbirdio/netbird/shared/management/domain"
@@ -229,6 +230,10 @@ func New(opts Options) (*Client, error) {
 	if err != nil {
 		return nil, fmt.Errorf("create config: %w", err)
 	}
+	// Embedded path runs without the daemon Server: apply the active
+	// MDM policy explicitly so a forced ManagementURL / PSK / other
+	// managed key takes effect on this embedded engine instance.
+	config.ApplyMDMPolicy(mdm.NewLoader(nil).Load())
 
 	if opts.PrivateKey != "" {
 		config.PrivateKey = opts.PrivateKey
diff --git a/client/internal/dns/service_listener.go b/client/internal/dns/service_listener.go
index 3dc29c4dc..d65a727b1 100644
--- a/client/internal/dns/service_listener.go
+++ b/client/internal/dns/service_listener.go
@@ -6,6 +6,7 @@ import (
 	"net"
 	"net/netip"
 	"runtime"
+	"slices"
 	"strconv"
 	"sync"
 	"time"
@@ -17,17 +18,20 @@ import (
 	nberrors "github.com/netbirdio/netbird/client/errors"
 
 	firewall "github.com/netbirdio/netbird/client/firewall/manager"
-	"github.com/netbirdio/netbird/client/internal/ebpf"
-	ebpfMgr "github.com/netbirdio/netbird/client/internal/ebpf/manager"
 )
 
 const (
 	customPort = 5053
+	// randomPortAttempts bounds the search for a port free on both protocols.
+	randomPortAttempts = 5
 )
 
 var (
 	defaultIP = netip.MustParseAddr("127.0.0.1")
 	customIP  = netip.MustParseAddr("127.0.0.153")
+
+	// dnatProtocols are the protocols the port 53 redirect covers.
+	dnatProtocols = []firewall.Protocol{firewall.ProtocolUDP, firewall.ProtocolTCP}
 )
 
 type serviceViaListener struct {
@@ -40,9 +44,20 @@ type serviceViaListener struct {
 	listenPort        uint16
 	listenerIsRunning bool
 	listenerFlagLock  sync.Mutex
-	ebpfService       ebpfMgr.Manager
 	firewall          Firewall
-	tcpDNATConfigured bool
+	// dnatRules holds the port 53 redirects that are installed and not yet
+	// removed, so a removal that fails can be retried.
+	dnatRules []dnatRule
+}
+
+// dnatRule is a port 53 redirect as it was installed. The target is kept with
+// the rule because the listener can come back on a different address or port,
+// and a retried removal has to name the address and port the rule was added
+// with, not the ones in use now.
+type dnatRule struct {
+	protocol firewall.Protocol
+	ip       netip.Addr
+	port     uint16
 }
 
 func newServiceViaListener(wgIface WGIface, customAddr *netip.AddrPort, fw Firewall) *serviceViaListener {
@@ -112,34 +127,93 @@ func (s *serviceViaListener) Listen() error {
 		}
 	}()
 
-	// When eBPF redirects UDP port 53 to our listen port, TCP still needs
-	// a DNAT rule because eBPF only handles UDP.
-	if s.ebpfService != nil && s.firewall != nil && s.listenPort != DefaultPort {
-		if err := s.firewall.AddOutputDNAT(s.listenIP, firewall.ProtocolTCP, DefaultPort, s.listenPort); err != nil {
-			log.Warnf("failed to add DNS TCP DNAT rule, TCP DNS on port 53 will not work: %v", err)
-		} else {
-			s.tcpDNATConfigured = true
-			log.Infof("added DNS TCP DNAT rule: %s:%d -> %s:%d", s.listenIP, DefaultPort, s.listenIP, s.listenPort)
-		}
+	if s.listenPort != DefaultPort {
+		s.setupDNAT()
 	}
 
 	return nil
 }
 
+// setupDNAT redirects port 53 to the port the DNS server actually listens on.
+// Both protocols must be redirected or none: RuntimePort reports port 53 only
+// while the full redirect is in place, so a half-configured redirect would
+// advertise a resolver that answers over one protocol.
+func (s *serviceViaListener) setupDNAT() {
+	if s.firewall == nil {
+		log.Errorf("no firewall manager available to redirect DNS port %d to %d, "+
+			"clients pointed at %s will not reach the resolver", DefaultPort, s.listenPort, s.listenIP)
+		return
+	}
+
+	// Clear whatever an earlier removal left behind first. Those rules can point
+	// at an address or port this listener no longer uses, and they are matched
+	// before anything added now, so adding a redirect on top of one would keep
+	// sending port 53 traffic to the previous listener while reporting the
+	// redirect as complete. The rules stay recorded for a later attempt.
+	if err := s.removeDNAT(); err != nil {
+		log.Errorf("failed to remove stale DNS DNAT rules, leaving port %d redirected to the previous listener: %v",
+			DefaultPort, err)
+		return
+	}
+
+	for _, proto := range dnatProtocols {
+		if err := s.firewall.AddOutputDNAT(s.listenIP, proto, DefaultPort, s.listenPort); err != nil {
+			log.Errorf("failed to add DNS %s DNAT rule, DNS on port %d will not work: %v",
+				proto, DefaultPort, err)
+			if err := s.removeDNAT(); err != nil {
+				log.Warnf("failed to roll back DNS DNAT rules, retrying on stop: %v", err)
+			}
+			return
+		}
+		s.dnatRules = append(s.dnatRules, dnatRule{protocol: proto, ip: s.listenIP, port: s.listenPort})
+	}
+
+	log.Infof("added DNS DNAT rules: %s:%d -> %s:%d (UDP + TCP)", s.listenIP, DefaultPort, s.listenIP, s.listenPort)
+}
+
+// removeDNAT removes every installed port 53 redirect. A rule whose removal
+// fails stays recorded so a later setup or Stop retries it, rather than leaving
+// port 53 pointing at a resolver that is no longer listening.
+func (s *serviceViaListener) removeDNAT() error {
+	if s.firewall == nil {
+		return nil
+	}
+
+	var merr *multierror.Error
+	var remaining []dnatRule
+	for _, rule := range s.dnatRules {
+		if err := s.firewall.RemoveOutputDNAT(rule.ip, rule.protocol, DefaultPort, rule.port); err != nil {
+			merr = multierror.Append(merr, fmt.Errorf("remove DNS %s DNAT rule for %s:%d: %w",
+				rule.protocol, rule.ip, rule.port, err))
+			remaining = append(remaining, rule)
+		}
+	}
+	s.dnatRules = remaining
+
+	return nberrors.FormatErrorOrNil(merr)
+}
+
 func (s *serviceViaListener) Stop() error {
 	s.listenerFlagLock.Lock()
 	defer s.listenerFlagLock.Unlock()
 
+	var merr *multierror.Error
+
+	// Redirects are removed even when the listener is already stopped, so that
+	// a removal which failed earlier is retried instead of leaving port 53
+	// pointing at a resolver that no longer listens.
+	if err := s.removeDNAT(); err != nil {
+		merr = multierror.Append(merr, err)
+	}
+
 	if !s.listenerIsRunning {
-		return nil
+		return nberrors.FormatErrorOrNil(merr)
 	}
 	s.listenerIsRunning = false
 
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 
-	var merr *multierror.Error
-
 	if err := s.server.ShutdownContext(ctx); err != nil {
 		merr = multierror.Append(merr, fmt.Errorf("stop DNS UDP server: %w", err))
 	}
@@ -148,19 +222,6 @@ func (s *serviceViaListener) Stop() error {
 		merr = multierror.Append(merr, fmt.Errorf("stop DNS TCP server: %w", err))
 	}
 
-	if s.tcpDNATConfigured && s.firewall != nil {
-		if err := s.firewall.RemoveOutputDNAT(s.listenIP, firewall.ProtocolTCP, DefaultPort, s.listenPort); err != nil {
-			merr = multierror.Append(merr, fmt.Errorf("remove DNS TCP DNAT rule: %w", err))
-		}
-		s.tcpDNATConfigured = false
-	}
-
-	if s.ebpfService != nil {
-		if err := s.ebpfService.FreeDNSFwd(); err != nil {
-			merr = multierror.Append(merr, fmt.Errorf("stop traffic forwarder: %w", err))
-		}
-	}
-
 	return nberrors.FormatErrorOrNil(merr)
 }
 
@@ -177,11 +238,23 @@ func (s *serviceViaListener) RuntimePort() int {
 	s.listenerFlagLock.Lock()
 	defer s.listenerFlagLock.Unlock()
 
-	if s.ebpfService != nil {
+	if s.redirectInstalled() {
 		return DefaultPort
-	} else {
-		return int(s.listenPort)
 	}
+	return int(s.listenPort)
+}
+
+// redirectInstalled reports whether every protocol is redirected from port 53
+// to the address and port the listener currently serves. Rules left over from
+// an earlier listener do not count.
+func (s *serviceViaListener) redirectInstalled() bool {
+	for _, proto := range dnatProtocols {
+		current := dnatRule{protocol: proto, ip: s.listenIP, port: s.listenPort}
+		if !slices.Contains(s.dnatRules, current) {
+			return false
+		}
+	}
+	return true
 }
 
 func (s *serviceViaListener) RuntimeIP() netip.Addr {
@@ -190,30 +263,29 @@ func (s *serviceViaListener) RuntimeIP() netip.Addr {
 
 // evalListenAddress figures out the listen address for the DNS server.
 // IPv4-only: all peers have a v4 overlay address, and DNS config points to v4.
-// First checks port 53 on WG interface or lo, then tries eBPF on a random port,
-// then falls back to port 5053.
+// Prefers port 53 on the overlay interface or lo, so no redirect is needed at
+// all; when it is taken it falls back to port 5053 and then to a random free
+// port, both of which need the port 53 redirect set up by setupDNAT.
 func (s *serviceViaListener) evalListenAddress() (netip.Addr, uint16, error) {
 	if s.customAddr != nil {
 		return s.customAddr.Addr(), s.customAddr.Port(), nil
 	}
 
-	ip, ok := s.testFreePort(DefaultPort)
-	if ok {
+	if ip, ok := s.testFreePort(DefaultPort); ok {
 		return ip, DefaultPort, nil
 	}
 
-	ebpfSrv, port, ok := s.tryToUseeBPF()
-	if ok {
-		s.ebpfService = ebpfSrv
-		return s.wgInterface.Address().IP, port, nil
-	}
-
-	ip, ok = s.testFreePort(customPort)
-	if ok {
+	if ip, ok := s.testFreePort(customPort); ok {
 		return ip, customPort, nil
 	}
 
-	return netip.Addr{}, 0, fmt.Errorf("failed to find a free port for DNS server")
+	ip := s.wgInterface.Address().IP
+	port, err := s.randomFreePort(ip)
+	if err != nil {
+		return netip.Addr{}, 0, fmt.Errorf("find a free port for DNS server: %w", err)
+	}
+
+	return ip, port, nil
 }
 
 func (s *serviceViaListener) testFreePort(port int) (netip.Addr, bool) {
@@ -260,48 +332,25 @@ func (s *serviceViaListener) tryToBind(ip netip.Addr, port int) bool {
 	return true
 }
 
-// tryToUseeBPF decides whether to apply eBPF program to capture DNS traffic on port 53.
-// This is needed because on some operating systems if we start a DNS server not on a default port 53,
-// the domain name  resolution won't work. So, in case we are running on Linux and picked a free
-// port we should fall back to the eBPF solution that will capture traffic on port 53 and forward
-// it to a local DNS server running on the chosen port.
-func (s *serviceViaListener) tryToUseeBPF() (ebpfMgr.Manager, uint16, bool) {
-	if runtime.GOOS != "linux" {
-		return nil, 0, false
+// randomFreePort returns a port that is free on ip for both UDP and TCP, since
+// the DNS server binds both. The probe listeners are closed again, so the port
+// is only likely, not guaranteed, to still be free when the server binds it.
+func (s *serviceViaListener) randomFreePort(ip netip.Addr) (uint16, error) {
+	for range randomPortAttempts {
+		probeListener, err := net.ListenUDP("udp4", &net.UDPAddr{})
+		if err != nil {
+			return 0, fmt.Errorf("bind random port: %w", err)
+		}
+
+		port := uint16(probeListener.LocalAddr().(*net.UDPAddr).Port)
+		if err := probeListener.Close(); err != nil {
+			return 0, fmt.Errorf("free up probed port: %w", err)
+		}
+
+		if s.tryToBind(ip, int(port)) {
+			return port, nil
+		}
 	}
 
-	port, err := s.generateFreePort() //nolint:staticcheck,unused
-	if err != nil {
-		log.Warnf("failed to generate a free port for eBPF DNS forwarder server: %s", err)
-		return nil, 0, false
-	}
-
-	ebpfSrv := ebpf.GetEbpfManagerInstance()
-	err = ebpfSrv.LoadDNSFwd(s.wgInterface.Address().IP, int(port))
-	if err != nil {
-		log.Warnf("failed to load DNS forwarder eBPF program, error: %s", err)
-		return nil, 0, false
-	}
-
-	return ebpfSrv, port, true
-}
-
-func (s *serviceViaListener) generateFreePort() (uint16, error) {
-	ok := s.tryToBind(s.wgInterface.Address().IP, customPort)
-	if ok {
-		return customPort, nil
-	}
-
-	probeListener, err := net.ListenUDP("udp4", &net.UDPAddr{})
-	if err != nil {
-		log.Debugf("failed to bind random port for DNS: %s", err)
-		return 0, err
-	}
-
-	port := uint16(probeListener.LocalAddr().(*net.UDPAddr).Port)
-	if err = probeListener.Close(); err != nil {
-		log.Debugf("failed to free up DNS port: %s", err)
-		return 0, err
-	}
-	return port, nil
+	return 0, fmt.Errorf("no port free for UDP and TCP on %s after %d attempts", ip, randomPortAttempts)
 }
diff --git a/client/internal/dns/service_listener_test.go b/client/internal/dns/service_listener_test.go
index 90ef71d19..b158a79fd 100644
--- a/client/internal/dns/service_listener_test.go
+++ b/client/internal/dns/service_listener_test.go
@@ -1,6 +1,7 @@
 package dns
 
 import (
+	"errors"
 	"fmt"
 	"net"
 	"net/netip"
@@ -10,6 +11,8 @@ import (
 	"github.com/miekg/dns"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+
+	firewall "github.com/netbirdio/netbird/client/firewall/manager"
 )
 
 func TestServiceViaListener_TCPAndUDP(t *testing.T) {
@@ -84,3 +87,133 @@ func TestServiceViaListener_TCPAndUDP(t *testing.T) {
 	require.NotEmpty(t, tcpResp.Answer)
 	assert.Contains(t, tcpResp.Answer[0].String(), "192.0.2.1", "TCP response should contain expected IP")
 }
+
+type dnatCall struct {
+	rule  dnatRule
+	added bool
+}
+
+// fakeFirewall records DNAT calls and fails the ones named in addErrs/removeErrs.
+type fakeFirewall struct {
+	calls      []dnatCall
+	addErrs    map[firewall.Protocol]error
+	removeErrs map[firewall.Protocol]error
+}
+
+func (f *fakeFirewall) AddOutputDNAT(ip netip.Addr, protocol firewall.Protocol, _, translatedPort uint16) error {
+	if err := f.addErrs[protocol]; err != nil {
+		return err
+	}
+	f.calls = append(f.calls, dnatCall{rule: dnatRule{protocol: protocol, ip: ip, port: translatedPort}, added: true})
+	return nil
+}
+
+func (f *fakeFirewall) RemoveOutputDNAT(ip netip.Addr, protocol firewall.Protocol, _, translatedPort uint16) error {
+	if err := f.removeErrs[protocol]; err != nil {
+		return err
+	}
+	f.calls = append(f.calls, dnatCall{rule: dnatRule{protocol: protocol, ip: ip, port: translatedPort}})
+	return nil
+}
+
+func newDNATTestService(fw Firewall) *serviceViaListener {
+	return &serviceViaListener{
+		listenIP:   netip.MustParseAddr("100.64.0.1"),
+		listenPort: customPort,
+		firewall:   fw,
+	}
+}
+
+func TestSetupDNAT_BothProtocols(t *testing.T) {
+	svc := newDNATTestService(&fakeFirewall{})
+
+	svc.setupDNAT()
+
+	assert.Len(t, svc.dnatRules, len(dnatProtocols))
+	assert.Equal(t, DefaultPort, svc.RuntimePort(), "port 53 is advertised once both redirects are installed")
+}
+
+func TestSetupDNAT_RollsBackPartialRedirect(t *testing.T) {
+	fw := &fakeFirewall{addErrs: map[firewall.Protocol]error{firewall.ProtocolTCP: errors.New("nftables busy")}}
+	svc := newDNATTestService(fw)
+
+	svc.setupDNAT()
+
+	assert.Empty(t, svc.dnatRules, "the UDP redirect installed before the failure must be rolled back")
+	assert.Equal(t, int(svc.listenPort), svc.RuntimePort(), "an incomplete redirect must not advertise port 53")
+	udp := dnatRule{protocol: firewall.ProtocolUDP, ip: svc.listenIP, port: svc.listenPort}
+	assert.Contains(t, fw.calls, dnatCall{rule: udp}, "UDP removal should have been attempted")
+}
+
+// A rollback that fails must keep the rule recorded, so port 53 is not left
+// redirected to a resolver that no longer listens.
+func TestStop_RetriesFailedDNATRemoval(t *testing.T) {
+	fw := &fakeFirewall{
+		addErrs:    map[firewall.Protocol]error{firewall.ProtocolTCP: errors.New("nftables busy")},
+		removeErrs: map[firewall.Protocol]error{firewall.ProtocolUDP: errors.New("nftables busy")},
+	}
+	svc := newDNATTestService(fw)
+
+	svc.setupDNAT()
+	udp := dnatRule{protocol: firewall.ProtocolUDP, ip: svc.listenIP, port: svc.listenPort}
+	require.Equal(t, []dnatRule{udp}, svc.dnatRules, "a failed rollback keeps the rule for a later retry")
+
+	require.Error(t, svc.Stop(), "the failing removal should be reported")
+	require.Equal(t, []dnatRule{udp}, svc.dnatRules)
+
+	delete(fw.removeErrs, firewall.ProtocolUDP)
+	require.NoError(t, svc.Stop(), "a later stop retries the removal")
+	assert.Empty(t, svc.dnatRules)
+}
+
+// A stale rule that cannot be removed is matched before anything added now, so
+// no new redirect may be installed on top of it and port 53 must not be
+// advertised as reaching this listener.
+func TestSetupDNAT_AbortsWhileStaleRuleRemains(t *testing.T) {
+	fw := &fakeFirewall{removeErrs: map[firewall.Protocol]error{firewall.ProtocolUDP: errors.New("nftables busy")}}
+	svc := newDNATTestService(fw)
+	stalePort := svc.listenPort
+
+	svc.setupDNAT()
+	require.Error(t, svc.Stop())
+	staleUDP := dnatRule{protocol: firewall.ProtocolUDP, ip: svc.listenIP, port: stalePort}
+	require.Equal(t, []dnatRule{staleUDP}, svc.dnatRules)
+
+	svc.listenPort = stalePort + 1
+	fw.calls = nil
+
+	svc.setupDNAT()
+
+	assert.Equal(t, []dnatRule{staleUDP}, svc.dnatRules, "the stale rule stays recorded for a later attempt")
+	for _, call := range fw.calls {
+		assert.False(t, call.added, "no redirect may be installed while a stale one is still in place")
+	}
+	assert.Equal(t, int(svc.listenPort), svc.RuntimePort(), "port 53 must not be advertised")
+}
+
+// A rule left behind by a failed removal must be removed with the address and
+// port it was installed with, even when the listener has since moved to another
+// port, and it must not count towards the redirect the new listener advertises.
+func TestSetupDNAT_ClearsStaleRuleAfterPortChange(t *testing.T) {
+	fw := &fakeFirewall{removeErrs: map[firewall.Protocol]error{firewall.ProtocolUDP: errors.New("nftables busy")}}
+	svc := newDNATTestService(fw)
+	stalePort := svc.listenPort
+
+	svc.setupDNAT()
+	require.Error(t, svc.Stop())
+	staleUDP := dnatRule{protocol: firewall.ProtocolUDP, ip: svc.listenIP, port: stalePort}
+	require.Equal(t, []dnatRule{staleUDP}, svc.dnatRules)
+
+	delete(fw.removeErrs, firewall.ProtocolUDP)
+	svc.listenPort = stalePort + 1
+	fw.calls = nil
+
+	svc.setupDNAT()
+
+	assert.Contains(t, fw.calls, dnatCall{rule: staleUDP}, "the stale rule must be removed with its original port")
+	assert.Len(t, svc.dnatRules, len(dnatProtocols))
+	assert.Equal(t, DefaultPort, svc.RuntimePort(), "the new listener is fully redirected")
+	for _, rule := range svc.dnatRules {
+		assert.Equal(t, svc.listenPort, rule.port, "only rules for the current listener remain")
+	}
+}
diff --git a/client/internal/ebpf/ebpf/bpf_bpfeb.go b/client/internal/ebpf/ebpf/bpf_bpfeb.go
index 04b19883b..4b6230217 100644
--- a/client/internal/ebpf/ebpf/bpf_bpfeb.go
+++ b/client/internal/ebpf/ebpf/bpf_bpfeb.go
@@ -1,5 +1,5 @@
 // Code generated by bpf2go; DO NOT EDIT.
-//go:build arm64be || armbe || mips || mips64 || mips64p32 || ppc64 || s390 || s390x || sparc || sparc64
+//go:build mips || mips64 || ppc64 || s390x
 
 package ebpf
 
@@ -47,9 +47,10 @@ func loadBpfObjects(obj interface{}, opts *ebpf.CollectionOptions) error {
 type bpfSpecs struct {
 	bpfProgramSpecs
 	bpfMapSpecs
+	bpfVariableSpecs
 }
 
-// bpfSpecs contains programs before they are loaded into the kernel.
+// bpfProgramSpecs contains programs before they are loaded into the kernel.
 //
 // It can be passed ebpf.CollectionSpec.Assign.
 type bpfProgramSpecs struct {
@@ -61,17 +62,28 @@ type bpfProgramSpecs struct {
 // It can be passed ebpf.CollectionSpec.Assign.
 type bpfMapSpecs struct {
 	NbFeatures           *ebpf.MapSpec `ebpf:"nb_features"`
-	NbMapDnsIp           *ebpf.MapSpec `ebpf:"nb_map_dns_ip"`
-	NbMapDnsPort         *ebpf.MapSpec `ebpf:"nb_map_dns_port"`
 	NbWgProxySettingsMap *ebpf.MapSpec `ebpf:"nb_wg_proxy_settings_map"`
 }
 
+// bpfVariableSpecs contains global variables before they are loaded into the kernel.
+//
+// It can be passed ebpf.CollectionSpec.Assign.
+type bpfVariableSpecs struct {
+	FlagFeatureWgProxy *ebpf.VariableSpec `ebpf:"flag_feature_wg_proxy"`
+	MapKeyFeatures     *ebpf.VariableSpec `ebpf:"map_key_features"`
+	MapKeyProxyPort    *ebpf.VariableSpec `ebpf:"map_key_proxy_port"`
+	MapKeyWgPort       *ebpf.VariableSpec `ebpf:"map_key_wg_port"`
+	ProxyPort          *ebpf.VariableSpec `ebpf:"proxy_port"`
+	WgPort             *ebpf.VariableSpec `ebpf:"wg_port"`
+}
+
 // bpfObjects contains all objects after they have been loaded into the kernel.
 //
 // It can be passed to loadBpfObjects or ebpf.CollectionSpec.LoadAndAssign.
 type bpfObjects struct {
 	bpfPrograms
 	bpfMaps
+	bpfVariables
 }
 
 func (o *bpfObjects) Close() error {
@@ -86,20 +98,28 @@ func (o *bpfObjects) Close() error {
 // It can be passed to loadBpfObjects or ebpf.CollectionSpec.LoadAndAssign.
 type bpfMaps struct {
 	NbFeatures           *ebpf.Map `ebpf:"nb_features"`
-	NbMapDnsIp           *ebpf.Map `ebpf:"nb_map_dns_ip"`
-	NbMapDnsPort         *ebpf.Map `ebpf:"nb_map_dns_port"`
 	NbWgProxySettingsMap *ebpf.Map `ebpf:"nb_wg_proxy_settings_map"`
 }
 
 func (m *bpfMaps) Close() error {
 	return _BpfClose(
 		m.NbFeatures,
-		m.NbMapDnsIp,
-		m.NbMapDnsPort,
 		m.NbWgProxySettingsMap,
 	)
 }
 
+// bpfVariables contains all global variables after they have been loaded into the kernel.
+//
+// It can be passed to loadBpfObjects or ebpf.CollectionSpec.LoadAndAssign.
+type bpfVariables struct {
+	FlagFeatureWgProxy *ebpf.Variable `ebpf:"flag_feature_wg_proxy"`
+	MapKeyFeatures     *ebpf.Variable `ebpf:"map_key_features"`
+	MapKeyProxyPort    *ebpf.Variable `ebpf:"map_key_proxy_port"`
+	MapKeyWgPort       *ebpf.Variable `ebpf:"map_key_wg_port"`
+	ProxyPort          *ebpf.Variable `ebpf:"proxy_port"`
+	WgPort             *ebpf.Variable `ebpf:"wg_port"`
+}
+
 // bpfPrograms contains all programs after they have been loaded into the kernel.
 //
 // It can be passed to loadBpfObjects or ebpf.CollectionSpec.LoadAndAssign.
diff --git a/client/internal/ebpf/ebpf/bpf_bpfeb.o b/client/internal/ebpf/ebpf/bpf_bpfeb.o
index 7433ad740..b435d4964 100644
Binary files a/client/internal/ebpf/ebpf/bpf_bpfeb.o and b/client/internal/ebpf/ebpf/bpf_bpfeb.o differ
diff --git a/client/internal/ebpf/ebpf/bpf_bpfel.go b/client/internal/ebpf/ebpf/bpf_bpfel.go
index 03b494aa2..f56efc901 100644
--- a/client/internal/ebpf/ebpf/bpf_bpfel.go
+++ b/client/internal/ebpf/ebpf/bpf_bpfel.go
@@ -1,5 +1,5 @@
 // Code generated by bpf2go; DO NOT EDIT.
-//go:build 386 || amd64 || amd64p32 || arm || arm64 || loong64 || mips64le || mips64p32le || mipsle || ppc64le || riscv64
+//go:build 386 || amd64 || arm || arm64 || loong64 || mips64le || mipsle || ppc64le || riscv64 || wasm
 
 package ebpf
 
@@ -47,9 +47,10 @@ func loadBpfObjects(obj interface{}, opts *ebpf.CollectionOptions) error {
 type bpfSpecs struct {
 	bpfProgramSpecs
 	bpfMapSpecs
+	bpfVariableSpecs
 }
 
-// bpfSpecs contains programs before they are loaded into the kernel.
+// bpfProgramSpecs contains programs before they are loaded into the kernel.
 //
 // It can be passed ebpf.CollectionSpec.Assign.
 type bpfProgramSpecs struct {
@@ -61,17 +62,28 @@ type bpfProgramSpecs struct {
 // It can be passed ebpf.CollectionSpec.Assign.
 type bpfMapSpecs struct {
 	NbFeatures           *ebpf.MapSpec `ebpf:"nb_features"`
-	NbMapDnsIp           *ebpf.MapSpec `ebpf:"nb_map_dns_ip"`
-	NbMapDnsPort         *ebpf.MapSpec `ebpf:"nb_map_dns_port"`
 	NbWgProxySettingsMap *ebpf.MapSpec `ebpf:"nb_wg_proxy_settings_map"`
 }
 
+// bpfVariableSpecs contains global variables before they are loaded into the kernel.
+//
+// It can be passed ebpf.CollectionSpec.Assign.
+type bpfVariableSpecs struct {
+	FlagFeatureWgProxy *ebpf.VariableSpec `ebpf:"flag_feature_wg_proxy"`
+	MapKeyFeatures     *ebpf.VariableSpec `ebpf:"map_key_features"`
+	MapKeyProxyPort    *ebpf.VariableSpec `ebpf:"map_key_proxy_port"`
+	MapKeyWgPort       *ebpf.VariableSpec `ebpf:"map_key_wg_port"`
+	ProxyPort          *ebpf.VariableSpec `ebpf:"proxy_port"`
+	WgPort             *ebpf.VariableSpec `ebpf:"wg_port"`
+}
+
 // bpfObjects contains all objects after they have been loaded into the kernel.
 //
 // It can be passed to loadBpfObjects or ebpf.CollectionSpec.LoadAndAssign.
 type bpfObjects struct {
 	bpfPrograms
 	bpfMaps
+	bpfVariables
 }
 
 func (o *bpfObjects) Close() error {
@@ -86,20 +98,28 @@ func (o *bpfObjects) Close() error {
 // It can be passed to loadBpfObjects or ebpf.CollectionSpec.LoadAndAssign.
 type bpfMaps struct {
 	NbFeatures           *ebpf.Map `ebpf:"nb_features"`
-	NbMapDnsIp           *ebpf.Map `ebpf:"nb_map_dns_ip"`
-	NbMapDnsPort         *ebpf.Map `ebpf:"nb_map_dns_port"`
 	NbWgProxySettingsMap *ebpf.Map `ebpf:"nb_wg_proxy_settings_map"`
 }
 
 func (m *bpfMaps) Close() error {
 	return _BpfClose(
 		m.NbFeatures,
-		m.NbMapDnsIp,
-		m.NbMapDnsPort,
 		m.NbWgProxySettingsMap,
 	)
 }
 
+// bpfVariables contains all global variables after they have been loaded into the kernel.
+//
+// It can be passed to loadBpfObjects or ebpf.CollectionSpec.LoadAndAssign.
+type bpfVariables struct {
+	FlagFeatureWgProxy *ebpf.Variable `ebpf:"flag_feature_wg_proxy"`
+	MapKeyFeatures     *ebpf.Variable `ebpf:"map_key_features"`
+	MapKeyProxyPort    *ebpf.Variable `ebpf:"map_key_proxy_port"`
+	MapKeyWgPort       *ebpf.Variable `ebpf:"map_key_wg_port"`
+	ProxyPort          *ebpf.Variable `ebpf:"proxy_port"`
+	WgPort             *ebpf.Variable `ebpf:"wg_port"`
+}
+
 // bpfPrograms contains all programs after they have been loaded into the kernel.
 //
 // It can be passed to loadBpfObjects or ebpf.CollectionSpec.LoadAndAssign.
diff --git a/client/internal/ebpf/ebpf/bpf_bpfel.o b/client/internal/ebpf/ebpf/bpf_bpfel.o
index 779f43a00..a388b6d6d 100644
Binary files a/client/internal/ebpf/ebpf/bpf_bpfel.o and b/client/internal/ebpf/ebpf/bpf_bpfel.o differ
diff --git a/client/internal/ebpf/ebpf/dns_fwd_linux.go b/client/internal/ebpf/ebpf/dns_fwd_linux.go
deleted file mode 100644
index 1e7774573..000000000
--- a/client/internal/ebpf/ebpf/dns_fwd_linux.go
+++ /dev/null
@@ -1,52 +0,0 @@
-package ebpf
-
-import (
-	"encoding/binary"
-	"fmt"
-	"net/netip"
-
-	log "github.com/sirupsen/logrus"
-)
-
-const (
-	mapKeyDNSIP   uint32 = 0
-	mapKeyDNSPort uint32 = 1
-)
-
-func (tf *GeneralManager) LoadDNSFwd(ip netip.Addr, dnsPort int) error {
-	log.Debugf("load eBPF DNS forwarder, watching addr: %s:53, redirect to port: %d", ip, dnsPort)
-	tf.lock.Lock()
-	defer tf.lock.Unlock()
-
-	err := tf.loadXdp()
-	if err != nil {
-		return err
-	}
-
-	if !ip.Is4() {
-		return fmt.Errorf("eBPF DNS forwarder only supports IPv4, got %s", ip)
-	}
-	ip4 := ip.As4()
-	err = tf.bpfObjs.NbMapDnsIp.Put(mapKeyDNSIP, binary.BigEndian.Uint32(ip4[:]))
-	if err != nil {
-		return err
-	}
-
-	err = tf.bpfObjs.NbMapDnsPort.Put(mapKeyDNSPort, uint16(dnsPort))
-	if err != nil {
-		return err
-	}
-
-	tf.setFeatureFlag(featureFlagDnsForwarder)
-	err = tf.bpfObjs.NbFeatures.Put(mapKeyFeatures, tf.featureFlags)
-	if err != nil {
-		return err
-	}
-	return nil
-}
-
-func (tf *GeneralManager) FreeDNSFwd() error {
-	log.Debugf("free ebpf DNS forwarder")
-	return tf.unsetFeatureFlag(featureFlagDnsForwarder)
-}
-
diff --git a/client/internal/ebpf/ebpf/manager_linux.go b/client/internal/ebpf/ebpf/manager_linux.go
index 7520a6387..a13f5f19a 100644
--- a/client/internal/ebpf/ebpf/manager_linux.go
+++ b/client/internal/ebpf/ebpf/manager_linux.go
@@ -15,8 +15,7 @@ import (
 const (
 	mapKeyFeatures uint32 = 0
 
-	featureFlagWGProxy      = 0b00000001
-	featureFlagDnsForwarder = 0b00000010
+	featureFlagWGProxy = 0b00000001
 )
 
 var (
@@ -28,9 +27,9 @@ var (
 
 // GeneralManager is used to load multiple eBPF programs with a custom check (if then) done in prog.c
 // The manager simply adds a feature (byte) of each program to a map that is shared between the userspace and kernel.
-// When packet arrives, the C code checks for each feature (if it is set) and executes each enabled program (e.g., dns_fwd.c and wg_proxy.c).
+// When packet arrives, the C code checks for each feature (if it is set) and executes each enabled program (e.g., wg_proxy.c).
 //
-//go:generate go run github.com/cilium/ebpf/cmd/bpf2go -cc clang-14 bpf src/prog.c -- -I /usr/x86_64-linux-gnu/include
+//go:generate go run github.com/cilium/ebpf/cmd/bpf2go -cc clang-14 bpf src/prog.c -- -I /usr/x86_64-linux-gnu/include -include src/bpf_map_def.h
 type GeneralManager struct {
 	lock         sync.Mutex
 	link         link.Link
diff --git a/client/internal/ebpf/ebpf/manager_linux_test.go b/client/internal/ebpf/ebpf/manager_linux_test.go
index 5664a4565..e09fcb977 100644
--- a/client/internal/ebpf/ebpf/manager_linux_test.go
+++ b/client/internal/ebpf/ebpf/manager_linux_test.go
@@ -7,33 +7,24 @@ import (
 func TestManager_setFeatureFlag(t *testing.T) {
 	mgr := GeneralManager{}
 	mgr.setFeatureFlag(featureFlagWGProxy)
-	if mgr.featureFlags != 1 {
+	if mgr.featureFlags != featureFlagWGProxy {
 		t.Errorf("invalid feature state")
 	}
 
-	mgr.setFeatureFlag(featureFlagDnsForwarder)
-	if mgr.featureFlags != 3 {
-		t.Errorf("invalid feature state")
+	mgr.setFeatureFlag(featureFlagWGProxy)
+	if mgr.featureFlags != featureFlagWGProxy {
+		t.Errorf("setting a flag twice must be idempotent, got: %d", mgr.featureFlags)
 	}
 }
 
 func TestManager_unsetFeatureFlag(t *testing.T) {
 	mgr := GeneralManager{}
 	mgr.setFeatureFlag(featureFlagWGProxy)
-	mgr.setFeatureFlag(featureFlagDnsForwarder)
 
 	err := mgr.unsetFeatureFlag(featureFlagWGProxy)
 	if err != nil {
 		t.Errorf("unexpected error: %s", err)
 	}
-	if mgr.featureFlags != 2 {
-		t.Errorf("invalid feature state, expected: %d, got: %d", 2, mgr.featureFlags)
-	}
-
-	err = mgr.unsetFeatureFlag(featureFlagDnsForwarder)
-	if err != nil {
-		t.Errorf("unexpected error: %s", err)
-	}
 	if mgr.featureFlags != 0 {
 		t.Errorf("invalid feature state, expected: %d, got: %d", 0, mgr.featureFlags)
 	}
diff --git a/client/internal/ebpf/ebpf/src/bpf_map_def.h b/client/internal/ebpf/ebpf/src/bpf_map_def.h
new file mode 100644
index 000000000..9528fb592
--- /dev/null
+++ b/client/internal/ebpf/ebpf/src/bpf_map_def.h
@@ -0,0 +1,16 @@
+// libbpf 1.0 removed struct bpf_map_def, but the programs here keep the legacy
+// map definitions: they load on kernels built without BTF, which BTF-style
+// (SEC(".maps")) definitions do not. Define the struct ourselves so the
+// programs compile against current libbpf headers.
+#ifndef NB_BPF_MAP_DEF_H
+#define NB_BPF_MAP_DEF_H
+
+struct bpf_map_def {
+	unsigned int type;
+	unsigned int key_size;
+	unsigned int value_size;
+	unsigned int max_entries;
+	unsigned int map_flags;
+};
+
+#endif
diff --git a/client/internal/ebpf/ebpf/src/dns_fwd.c b/client/internal/ebpf/ebpf/src/dns_fwd.c
deleted file mode 100644
index 9f8de2001..000000000
--- a/client/internal/ebpf/ebpf/src/dns_fwd.c
+++ /dev/null
@@ -1,67 +0,0 @@
-const __u32 map_key_dns_ip = 0;
-const __u32 map_key_dns_port = 1;
-
-struct bpf_map_def SEC("maps") nb_map_dns_ip = {
-	.type = BPF_MAP_TYPE_ARRAY,
-	.key_size = sizeof(__u32),
-	.value_size = sizeof(__u32),
-	.max_entries = 10,
-};
-
-struct bpf_map_def SEC("maps") nb_map_dns_port = {
-	.type = BPF_MAP_TYPE_ARRAY,
-	.key_size = sizeof(__u32),
-	.value_size = sizeof(__u16),
-	.max_entries = 10,
-};
-
-__be32 dns_ip = 0;
-__be16 dns_port = 0;
-
-// 13568 is 53 in big endian
-__be16 GENERAL_DNS_PORT = 13568;
-
-bool read_settings() {
-    __u16 *port_value;
-    __u32 *ip_value;
-
-    // read dns ip
-    ip_value = bpf_map_lookup_elem(&nb_map_dns_ip, &map_key_dns_ip);
-    if(!ip_value) {
-        return false;
-    }
-    dns_ip = htonl(*ip_value);
-
-    // read dns port
-    port_value = bpf_map_lookup_elem(&nb_map_dns_port, &map_key_dns_port);
-    if (!port_value) {
-        return false;
-    }
-    dns_port = htons(*port_value);
-    return true;
-}
-
-int xdp_dns_fwd(struct iphdr  *ip, struct udphdr *udp) {
-    if (dns_port == 0) {
-        if(!read_settings()){
-            return XDP_PASS;
-        }
-        // bpf_printk("dns port: %d", ntohs(dns_port));
-        // bpf_printk("dns ip: %d", ntohl(dns_ip));
-    }
-
-    if (udp->dest == GENERAL_DNS_PORT && ip->daddr == dns_ip) {
-        udp->dest = dns_port;
-        // Clear the now-stale checksum; zero means "not computed" for IPv4.
-        udp->check = 0;
-        return XDP_PASS;
-    }
-
-    if (udp->source == dns_port && ip->saddr == dns_ip) {
-        udp->source = GENERAL_DNS_PORT;
-        udp->check = 0;
-        return XDP_PASS;
-    }
-
-    return XDP_PASS;
-}
diff --git a/client/internal/ebpf/ebpf/src/prog.c b/client/internal/ebpf/ebpf/src/prog.c
index f32103f28..44ee53458 100644
--- a/client/internal/ebpf/ebpf/src/prog.c
+++ b/client/internal/ebpf/ebpf/src/prog.c
@@ -5,11 +5,9 @@
 #include <netinet/in.h>
 #include <linux/bpf.h>
 #include <bpf/bpf_helpers.h>
-#include "dns_fwd.c"
 #include "wg_proxy.c"
 
 const __u16 flag_feature_wg_proxy = 0b01;
-const __u16 flag_feature_dns_fwd = 0b10;
 
 const __u32 map_key_features = 0;
 struct bpf_map_def SEC("maps") nb_features = {
@@ -48,10 +46,6 @@ int nb_xdp_prog(struct xdp_md *ctx) {
        return XDP_PASS;
     }
 
-    if (*features & flag_feature_dns_fwd) {
-        xdp_dns_fwd(ip, udp);
-    }
-
     if (*features & flag_feature_wg_proxy) {
         xdp_wg_proxy(ip, udp);
     }
diff --git a/client/internal/ebpf/ebpf/src/readme.md b/client/internal/ebpf/ebpf/src/readme.md
index 0ab393dd4..aa47847da 100644
--- a/client/internal/ebpf/ebpf/src/readme.md
+++ b/client/internal/ebpf/ebpf/src/readme.md
@@ -1,8 +1,18 @@
-# DNS forwarder
+# XDP programs
 
-The agent attach the XDP program to the lo device. We can not use fake address in eBPF because the
-traffic does not appear in the eBPF program. The program capture the traffic on wg_ip:53 and 
-overwrite in it the destination port to 5053.
+`prog.c` is attached to the `lo` device and dispatches to the features enabled in the
+`nb_features` map. The only feature is the WireGuard proxy (`wg_proxy.c`): it rewrites
+loopback UDP sent from the WireGuard listen port so it reaches the userspace relay proxy
+port instead, and swaps the peer endpoint port into the source so the proxy can tell
+peers apart.
+
+Maps use the legacy `struct bpf_map_def` form, defined in `bpf_map_def.h` because libbpf
+1.0 removed it. They load on kernels built without BTF, which BTF-style (`SEC(".maps")`)
+definitions do not.
+
+Regenerate the objects with `go generate ./client/internal/ebpf/ebpf/`; it needs
+`clang-14`. Loading a regenerated object needs root, attaching it needs `bpf_link`
+(kernel >= 5.7), and only one XDP program can own `lo` at a time.
 
 # Debug
 
diff --git a/client/internal/ebpf/manager/manager.go b/client/internal/ebpf/manager/manager.go
index 25a767090..fdc5d8d82 100644
--- a/client/internal/ebpf/manager/manager.go
+++ b/client/internal/ebpf/manager/manager.go
@@ -1,11 +1,7 @@
 package manager
 
-import "net/netip"
-
-// Manager is used to load multiple eBPF programs. E.g., current DNS programs and WireGuard proxy
+// Manager is used to load multiple eBPF programs. E.g., the WireGuard proxy
 type Manager interface {
-	LoadDNSFwd(ip netip.Addr, dnsPort int) error
-	FreeDNSFwd() error
 	LoadWgProxy(proxyPort, wgPort int) error
 	FreeWGProxy() error
 }
diff --git a/client/internal/engine.go b/client/internal/engine.go
index f8b65f7d8..d517d1d68 100644
--- a/client/internal/engine.go
+++ b/client/internal/engine.go
@@ -14,12 +14,14 @@ import (
 	"sort"
 	"strings"
 	"sync"
+	"sync/atomic"
 	"time"
 
 	"github.com/hashicorp/go-multierror"
 	"github.com/pion/ice/v4"
 	"github.com/pion/stun/v3"
 	log "github.com/sirupsen/logrus"
+	wgdevice "golang.zx2c4.com/wireguard/device"
 	"golang.zx2c4.com/wireguard/tun/netstack"
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 
@@ -236,6 +238,12 @@ type Engine struct {
 
 	wgInterface WGIface
 
+	// wgDevice is a lock-free handle on the WireGuard device behind
+	// wgInterface. Reaching the device through wgInterface requires
+	// syncMsgMux, which handleSync holds while it adds and removes peers;
+	// SetPerformance must stay reachable exactly when that work is stuck.
+	wgDevice atomic.Pointer[wgdevice.Device]
+
 	udpMux *udpmux.UniversalUDPMuxDefault
 
 	// networkSerial is the latest CurrentSerial (state ID) of the network sent by the Management service
@@ -651,6 +659,7 @@ func (e *Engine) Start(netbirdConfig *mgmProto.NetbirdConfig, mgmtURL *url.URL)
 		log.Errorf("failed to pull up wgInterface [%s]: %s", e.wgInterface.Name(), err.Error())
 		return fmt.Errorf("up wg interface: %w", err)
 	}
+	e.wgDevice.Store(e.wgInterface.GetWGDevice())
 
 	// Set up notrack rules immediately after proxy is listening to prevent
 	// conntrack entries from being created before the rules are in place
@@ -2144,6 +2153,10 @@ func (e *Engine) close() {
 	log.Debugf("removing Netbird interface %s", e.config.WgIfaceName)
 
 	if e.wgInterface != nil {
+		// Drop the handle before the close starts: a retune that loads it
+		// afterwards would touch a device on its way out and report success
+		// for an engine that is already gone.
+		e.wgDevice.Store(nil)
 		if err := e.wgInterface.Close(); err != nil {
 			log.Errorf("failed closing Netbird interface %s %v", e.config.WgIfaceName, err)
 		}
@@ -2303,15 +2316,16 @@ type Performance struct {
 }
 
 // SetPerformance applies the given tuning to this engine's live Device.
+//
+// It deliberately does not take syncMsgMux. Raising the buffer pool cap is the
+// recovery path for a device whose pool is exhausted, and an exhausted pool
+// blocks peer removal inside handleSync, which holds syncMsgMux for as long as
+// it stays blocked. Taking the lock here would make the retune unreachable in
+// the one situation that needs it.
 func (e *Engine) SetPerformance(t Performance) error {
-	e.syncMsgMux.Lock()
-	defer e.syncMsgMux.Unlock()
-	if e.wgInterface == nil {
-		return fmt.Errorf("wg interface not initialized")
-	}
-	dev := e.wgInterface.GetWGDevice()
+	dev := e.wgDevice.Load()
 	if dev == nil {
-		return fmt.Errorf("wg device not initialized")
+		return errors.New("wg device not initialized")
 	}
 	if t.PreallocatedBuffersPerPool != nil {
 		dev.SetPreallocatedBuffersPerPool(*t.PreallocatedBuffersPerPool)
diff --git a/client/internal/peer/handshaker.go b/client/internal/peer/handshaker.go
index 6ecb2a947..654e32158 100644
--- a/client/internal/peer/handshaker.go
+++ b/client/internal/peer/handshaker.go
@@ -116,7 +116,7 @@ func (h *Handshaker) Listen(ctx context.Context) {
 	for {
 		select {
 		case remoteOfferAnswer := <-h.remoteOffersCh:
-			h.log.Infof("received offer, running version %s, remote WireGuard listen port %d, session id: %s, remote ICE supported: %t", remoteOfferAnswer.Version, remoteOfferAnswer.WgListenPort, remoteOfferAnswer.SessionIDString(), remoteOfferAnswer.hasICECredentials())
+			h.log.Infof("received offer, running version %s, remote WireGuard listen port %d, session id: %s, remote ICE supported: %t, relay server: %s, relay IP: %s", remoteOfferAnswer.Version, remoteOfferAnswer.WgListenPort, remoteOfferAnswer.SessionIDString(), remoteOfferAnswer.hasICECredentials(), remoteOfferAnswer.RelaySrvAddress, remoteOfferAnswer.RelaySrvIP)
 
 			// Record signaling received for reconnection attempts
 			if h.metricsStages != nil {
@@ -138,7 +138,7 @@ func (h *Handshaker) Listen(ctx context.Context) {
 				continue
 			}
 		case remoteOfferAnswer := <-h.remoteAnswerCh:
-			h.log.Infof("received answer, running version %s, remote WireGuard listen port %d, session id: %s, remote ICE supported: %t", remoteOfferAnswer.Version, remoteOfferAnswer.WgListenPort, remoteOfferAnswer.SessionIDString(), remoteOfferAnswer.hasICECredentials())
+			h.log.Infof("received answer, running version %s, remote WireGuard listen port %d, session id: %s, remote ICE supported: %t, relay server: %s, relay IP: %s", remoteOfferAnswer.Version, remoteOfferAnswer.WgListenPort, remoteOfferAnswer.SessionIDString(), remoteOfferAnswer.hasICECredentials(), remoteOfferAnswer.RelaySrvAddress, remoteOfferAnswer.RelaySrvIP)
 
 			// Record signaling received for reconnection attempts
 			if h.metricsStages != nil {
@@ -209,14 +209,14 @@ func (h *Handshaker) sendOffer() error {
 	}
 
 	offer := h.buildOfferAnswer()
-	h.log.Debugf("sending offer with serial: %s", offer.SessionIDString())
+	h.log.Debugf("sending offer with serial: %s, relay server: %s, relay IP: %s", offer.SessionIDString(), offer.RelaySrvAddress, offer.RelaySrvIP)
 
 	return h.signaler.SignalOffer(offer, h.config.Key)
 }
 
 func (h *Handshaker) sendAnswer() error {
 	answer := h.buildOfferAnswer()
-	h.log.Debugf("sending answer with serial: %s", answer.SessionIDString())
+	h.log.Debugf("sending answer with serial: %s, relay server: %s, relay IP: %s", answer.SessionIDString(), answer.RelaySrvAddress, answer.RelaySrvIP)
 
 	return h.signaler.SignalAnswer(answer, h.config.Key)
 }
diff --git a/client/internal/profilemanager/config.go b/client/internal/profilemanager/config.go
index 10c1758d1..412f81b5c 100644
--- a/client/internal/profilemanager/config.go
+++ b/client/internal/profilemanager/config.go
@@ -58,10 +58,6 @@ var DefaultInterfaceBlacklist = []string{
 	"Tailscale", "tailscale", "docker", "veth", "br-", "lo",
 }
 
-// loadMDMPolicy is the package-level indirection used by apply() to read the
-// active MDM policy. Tests override this to inject a fake policy.
-var loadMDMPolicy = mdm.LoadPolicy
-
 // ConfigInput carries configuration changes to the client
 type ConfigInput struct {
 	ManagementURL                 string
@@ -202,14 +198,26 @@ type Config struct {
 
 	MTU uint16
 
-	// policy is the MDM policy that produced the currently-set values for
-	// any MDM-enforced fields. Set by applyMDMPolicy at the tail of apply()
-	// and reset on every apply() invocation. Never persisted to disk.
-	// Callers query enforcement state via Policy() and the mdm.Policy API
-	// (HasKey, ManagedKeys, IsEmpty).
+	// policy is the MDM policy that produced the currently-set values
+	// for any MDM-enforced fields. Set by ApplyMDMPolicy on every
+	// invocation. Never persisted to disk. Callers query enforcement
+	// state via Policy() and the mdm.Policy API (HasKey, ManagedKeys,
+	// IsEmpty).
 	policy *mdm.Policy `json:"-"`
 }
 
+// ApplyMDMPolicy overlays the supplied MDM Policy on top of the current
+// Config values and records it as Policy(). The overlay is not reversible:
+// an empty Policy only clears the enforcement metadata, so resolve the base
+// Config again (from disk or JSON) before applying a changed policy, the way
+// the lifecycle owners do on every load.
+func (config *Config) ApplyMDMPolicy(policy *mdm.Policy) {
+	if config == nil {
+		return
+	}
+	config.applyMDMPolicy(policy)
+}
+
 // Policy returns the MDM policy applied to this Config. Returns a non-nil
 // empty Policy when MDM enforcement is inactive; callers can always invoke
 // HasKey / ManagedKeys / IsEmpty without a nil check.
@@ -712,9 +720,11 @@ func (config *Config) apply(input ConfigInput) (updated bool, err error) {
 		updated = true
 	}
 
-	// MDM is the last override layer: any key present in the policy
-	// supersedes defaults, on-disk config, env vars and CLI input.
-	config.applyMDMPolicy(loadMDMPolicy())
+	// Initialise the MDM overlay to "no enforcement" so Config.Policy()
+	// never returns a stale or nil policy on a freshly applied Config.
+	// Lifecycle owners that want to enforce a real MDM policy invoke
+	// Config.ApplyMDMPolicy(loader.Load()) after this returns.
+	config.applyMDMPolicy(mdm.NewPolicy(nil))
 
 	return updated, nil
 }
diff --git a/client/internal/profilemanager/config_mdm.go b/client/internal/profilemanager/config_mdm.go
new file mode 100644
index 000000000..25b9f18f7
--- /dev/null
+++ b/client/internal/profilemanager/config_mdm.go
@@ -0,0 +1,52 @@
+package profilemanager
+
+import (
+	"errors"
+	"fmt"
+
+	"github.com/netbirdio/netbird/client/mdm"
+)
+
+// ErrMDMManagedFields marks a config change rejected because it diverges from
+// MDM-enforced values.
+var ErrMDMManagedFields = errors.New("fields managed by MDM cannot be modified")
+
+// MDMConflicts returns the names of MDM-managed keys whose requested value in
+// the ConfigInput differs from the policy-enforced value; a field set to the
+// enforced value is a no-op echo, not a conflict.
+func MDMConflicts(input ConfigInput, policy *mdm.Policy) []string {
+	pskGot := input.PreSharedKey
+	if isPreSharedKeyHidden(pskGot) {
+		pskGot = nil
+	}
+	var port *int64
+	if input.WireguardPort != nil {
+		v := int64(*input.WireguardPort)
+		port = &v
+	}
+	return mdm.ResolveConflicts(policy, []mdm.ConflictCheck{
+		mdm.ConflictURL(mdm.KeyManagementURL, input.ManagementURL),
+		mdm.ConflictStringPtr(mdm.KeyPreSharedKey, pskGot),
+		mdm.ConflictBool(mdm.KeyRosenpassEnabled, input.RosenpassEnabled),
+		mdm.ConflictBool(mdm.KeyRosenpassPermissive, input.RosenpassPermissive),
+		mdm.ConflictBool(mdm.KeyDisableAutoConnect, input.DisableAutoConnect),
+		mdm.ConflictBool(mdm.KeyAllowServerSSH, input.ServerSSHAllowed),
+		mdm.ConflictBool(mdm.KeyRemoteJobsAllowed, input.RemoteJobsAllowed),
+		mdm.ConflictBool(mdm.KeyDisableClientRoutes, input.DisableClientRoutes),
+		mdm.ConflictBool(mdm.KeyDisableServerRoutes, input.DisableServerRoutes),
+		mdm.ConflictBool(mdm.KeyBlockInbound, input.BlockInbound),
+		mdm.ConflictInt64(mdm.KeyWireguardPort, port),
+		mdm.ConflictBool(mdm.KeyEnableLocalMetrics, input.LocalMetricsEnabled),
+		mdm.ConflictStringPtr(mdm.KeyLocalMetricsAddress, input.LocalMetricsAddress),
+	})
+}
+
+// CheckMDMConflicts returns an ErrMDMManagedFields-wrapped error naming the
+// conflicting keys, or nil when the input does not fight the policy.
+func CheckMDMConflicts(input ConfigInput, policy *mdm.Policy) error {
+	conflicts := MDMConflicts(input, policy)
+	if len(conflicts) == 0 {
+		return nil
+	}
+	return fmt.Errorf("%w: %v", ErrMDMManagedFields, conflicts)
+}
diff --git a/client/internal/profilemanager/config_mdm_test.go b/client/internal/profilemanager/config_mdm_test.go
index f8dfddb33..716b7a553 100644
--- a/client/internal/profilemanager/config_mdm_test.go
+++ b/client/internal/profilemanager/config_mdm_test.go
@@ -10,24 +10,58 @@ import (
 	"github.com/netbirdio/netbird/client/mdm"
 )
 
-// withMDMPolicy temporarily overrides the package-level loadMDMPolicy hook so
-// apply() observes the supplied Policy. The original loader is restored at
-// test cleanup.
-func withMDMPolicy(t *testing.T, policy *mdm.Policy) {
+// fakeFetcher implements mdm.PolicyFetcher returning a pre-set policy
+// map. Test helper used to construct a Loader without touching the OS
+// or any package-level state.
+type fakeFetcher struct{ values map[string]any }
+
+func (f *fakeFetcher) Fetch() map[string]any { return f.values }
+
+// loaderFor builds an mdm.Loader whose loadPlatform returns the
+// supplied Policy's underlying values.
+func loaderFor(policy *mdm.Policy) *mdm.Loader {
+	if policy == nil || policy.IsEmpty() {
+		return mdm.NewLoader(&fakeFetcher{values: nil})
+	}
+	values := make(map[string]any)
+	for _, k := range policy.ManagedKeys() {
+		if v, ok := policy.GetString(k); ok {
+			values[k] = v
+			continue
+		}
+		if v, ok := policy.GetInt(k); ok {
+			values[k] = v
+			continue
+		}
+		if v, ok := policy.GetBool(k); ok {
+			values[k] = v
+			continue
+		}
+		if v, ok := policy.GetStringSlice(k); ok {
+			values[k] = v
+		}
+	}
+	return mdm.NewLoader(&fakeFetcher{values: values})
+}
+
+// configWithMDM is the test convenience that builds a Config via
+// UpdateOrCreateConfig and overlays the supplied MDM policy on top —
+// mirrors the production pattern (Server.getConfig / Client.applyMDMOverlay)
+// where the Loader lives outside Config and the apply step is driven
+// by the lifecycle owner.
+func configWithMDM(t *testing.T, input ConfigInput, policy *mdm.Policy) *Config {
 	t.Helper()
-	prev := loadMDMPolicy
-	loadMDMPolicy = func() *mdm.Policy { return policy }
-	t.Cleanup(func() { loadMDMPolicy = prev })
+	cfg, err := UpdateOrCreateConfig(input)
+	require.NoError(t, err)
+	require.NotNil(t, cfg)
+	cfg.ApplyMDMPolicy(loaderFor(policy).Load())
+	return cfg
 }
 
 func TestApply_MDMEmpty_NoEnforcement(t *testing.T) {
-	withMDMPolicy(t, mdm.NewPolicy(nil))
-
-	cfg, err := UpdateOrCreateConfig(ConfigInput{
+	cfg := configWithMDM(t, ConfigInput{
 		ConfigPath: filepath.Join(t.TempDir(), "config.json"),
-	})
-	require.NoError(t, err)
-	require.NotNil(t, cfg)
+	}, mdm.NewPolicy(nil))
 
 	assert.True(t, cfg.Policy().IsEmpty(), "no MDM source ⇒ empty Policy")
 	assert.False(t, cfg.Policy().HasKey(mdm.KeyManagementURL))
@@ -39,18 +73,15 @@ func TestApply_MDMEmpty_NoEnforcement(t *testing.T) {
 
 func TestApply_MDMOnly_OverridesDefaults(t *testing.T) {
 	const mdmURL = "https://corp.mdm.example.com:443"
-	withMDMPolicy(t, mdm.NewPolicy(map[string]any{
+
+	cfg := configWithMDM(t, ConfigInput{
+		ConfigPath: filepath.Join(t.TempDir(), "config.json"),
+	}, mdm.NewPolicy(map[string]any{
 		mdm.KeyManagementURL:       mdmURL,
 		mdm.KeyDisableClientRoutes: true,
 		mdm.KeyBlockInbound:        true,
 	}))
 
-	cfg, err := UpdateOrCreateConfig(ConfigInput{
-		ConfigPath: filepath.Join(t.TempDir(), "config.json"),
-	})
-	require.NoError(t, err)
-	require.NotNil(t, cfg)
-
 	assert.Equal(t, mdmURL, cfg.ManagementURL.String())
 	assert.True(t, cfg.DisableClientRoutes)
 	assert.True(t, cfg.BlockInbound)
@@ -65,16 +96,12 @@ func TestApply_MDMBeatsCLIInput(t *testing.T) {
 	const mdmURL = "https://mdm.example.com:443"
 	const cliURL = "https://cli.example.com:443"
 
-	withMDMPolicy(t, mdm.NewPolicy(map[string]any{
-		mdm.KeyManagementURL: mdmURL,
-	}))
-
-	cfg, err := UpdateOrCreateConfig(ConfigInput{
+	cfg := configWithMDM(t, ConfigInput{
 		ConfigPath:    filepath.Join(t.TempDir(), "config.json"),
 		ManagementURL: cliURL,
-	})
-	require.NoError(t, err)
-	require.NotNil(t, cfg)
+	}, mdm.NewPolicy(map[string]any{
+		mdm.KeyManagementURL: mdmURL,
+	}))
 
 	// MDM wins over CLI-supplied management URL.
 	assert.Equal(t, mdmURL, cfg.ManagementURL.String())
@@ -82,16 +109,12 @@ func TestApply_MDMBeatsCLIInput(t *testing.T) {
 }
 
 func TestApply_MDMInvalidURL_KeepsPreviousValue(t *testing.T) {
-	withMDMPolicy(t, mdm.NewPolicy(map[string]any{
+	cfg := configWithMDM(t, ConfigInput{
+		ConfigPath: filepath.Join(t.TempDir(), "config.json"),
+	}, mdm.NewPolicy(map[string]any{
 		mdm.KeyManagementURL: "not-a-url",
 	}))
 
-	cfg, err := UpdateOrCreateConfig(ConfigInput{
-		ConfigPath: filepath.Join(t.TempDir(), "config.json"),
-	})
-	require.NoError(t, err)
-	require.NotNil(t, cfg)
-
 	// Invalid MDM URL is logged and skipped: default URL stays in place
 	// to keep the client functional.
 	assert.Equal(t, DefaultManagementURL, cfg.ManagementURL.String())
@@ -106,24 +129,20 @@ func TestApply_MDMBoolKeysOverrideOnDiskValue(t *testing.T) {
 	tmp := filepath.Join(t.TempDir(), "config.json")
 
 	// Seed without MDM.
-	withMDMPolicy(t, mdm.NewPolicy(nil))
-	_, err := UpdateOrCreateConfig(ConfigInput{
+	configWithMDM(t, ConfigInput{
 		ConfigPath:          tmp,
 		DisableClientRoutes: boolPtr(false),
 		RosenpassEnabled:    boolPtr(false),
-	})
-	require.NoError(t, err)
+	}, mdm.NewPolicy(nil))
 
 	// Now enable MDM enforcement for these keys.
-	withMDMPolicy(t, mdm.NewPolicy(map[string]any{
+	cfg := configWithMDM(t, ConfigInput{
+		ConfigPath: tmp,
+	}, mdm.NewPolicy(map[string]any{
 		mdm.KeyDisableClientRoutes: true,
 		mdm.KeyRosenpassEnabled:    true,
 	}))
 
-	cfg, err := UpdateOrCreateConfig(ConfigInput{ConfigPath: tmp})
-	require.NoError(t, err)
-	require.NotNil(t, cfg)
-
 	assert.True(t, cfg.DisableClientRoutes, "MDM override should flip on-disk false to true")
 	assert.True(t, cfg.RosenpassEnabled)
 	assert.True(t, cfg.Policy().HasKey(mdm.KeyDisableClientRoutes))
@@ -134,22 +153,19 @@ func TestApply_MDMLocalMetrics(t *testing.T) {
 	tmp := filepath.Join(t.TempDir(), "config.json")
 
 	// Seed without MDM.
-	withMDMPolicy(t, mdm.NewPolicy(nil))
-	_, err := UpdateOrCreateConfig(ConfigInput{
+	configWithMDM(t, ConfigInput{
 		ConfigPath:          tmp,
 		LocalMetricsEnabled: boolPtr(false),
-	})
-	require.NoError(t, err)
+	}, mdm.NewPolicy(nil))
 
-	withMDMPolicy(t, mdm.NewPolicy(map[string]any{
+	// Now enable MDM enforcement for these keys.
+	cfg := configWithMDM(t, ConfigInput{
+		ConfigPath: tmp,
+	}, mdm.NewPolicy(map[string]any{
 		mdm.KeyEnableLocalMetrics:  true,
 		mdm.KeyLocalMetricsAddress: "127.0.0.1:9292",
 	}))
 
-	cfg, err := UpdateOrCreateConfig(ConfigInput{ConfigPath: tmp})
-	require.NoError(t, err)
-	require.NotNil(t, cfg)
-
 	assert.True(t, cfg.LocalMetricsEnabled, "MDM override should flip on-disk false to true")
 	assert.Equal(t, "127.0.0.1:9292", cfg.LocalMetricsAddress)
 	assert.True(t, cfg.Policy().HasKey(mdm.KeyEnableLocalMetrics))
@@ -171,16 +187,12 @@ func TestApply_MDMLazyConnection(t *testing.T) {
 	}
 	for _, c := range cases {
 		t.Run(c.name, func(t *testing.T) {
-			withMDMPolicy(t, mdm.NewPolicy(map[string]any{
+			cfg := configWithMDM(t, ConfigInput{
+				ConfigPath: filepath.Join(t.TempDir(), "config.json"),
+			}, mdm.NewPolicy(map[string]any{
 				mdm.KeyLazyConnection: c.raw,
 			}))
 
-			cfg, err := UpdateOrCreateConfig(ConfigInput{
-				ConfigPath: filepath.Join(t.TempDir(), "config.json"),
-			})
-			require.NoError(t, err)
-			require.NotNil(t, cfg)
-
 			assert.Equal(t, c.want, cfg.LazyConnection)
 			assert.True(t, cfg.Policy().HasKey(mdm.KeyLazyConnection))
 		})
@@ -188,22 +200,83 @@ func TestApply_MDMLazyConnection(t *testing.T) {
 }
 
 func TestApply_MDMPreSharedKeyRedactionSentinelRejected(t *testing.T) {
-	const maskSentinel = "**********"
+	const maskSentinel = mdm.PreSharedKeyRedactedSentinel
 
-	withMDMPolicy(t, mdm.NewPolicy(map[string]any{
+	cfg := configWithMDM(t, ConfigInput{
+		ConfigPath: filepath.Join(t.TempDir(), "config.json"),
+	}, mdm.NewPolicy(map[string]any{
 		mdm.KeyPreSharedKey: maskSentinel,
 	}))
 
-	cfg, err := UpdateOrCreateConfig(ConfigInput{
-		ConfigPath: filepath.Join(t.TempDir(), "config.json"),
-	})
-	require.NoError(t, err)
-	require.NotNil(t, cfg)
-
 	// Mask sentinel must not be persisted as the actual PSK.
 	assert.NotEqual(t, maskSentinel, cfg.PreSharedKey)
 	// Key still marked managed so user writes are still rejected.
 	assert.True(t, cfg.Policy().HasKey(mdm.KeyPreSharedKey))
 }
 
+func TestMDMConflicts_PreSharedKey(t *testing.T) {
+	policy := mdm.NewPolicy(map[string]any{
+		mdm.KeyPreSharedKey: "mdm-enforced-psk",
+	})
+	empty := ""
+	sentinel := mdm.PreSharedKeyRedactedSentinel
+	same := "mdm-enforced-psk"
+	other := "user-psk"
+
+	tests := []struct {
+		name string
+		psk  *string
+		want []string
+	}{
+		{name: "unset", psk: nil, want: nil},
+		{name: "explicit empty", psk: &empty, want: []string{mdm.KeyPreSharedKey}},
+		{name: "sentinel echo", psk: &sentinel, want: nil},
+		{name: "same value", psk: &same, want: nil},
+		{name: "divergent", psk: &other, want: []string{mdm.KeyPreSharedKey}},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			assert.Equal(t, tc.want, MDMConflicts(ConfigInput{PreSharedKey: tc.psk}, policy))
+		})
+	}
+}
+
+func TestMDMConflicts_RemoteJobsAndLocalMetrics(t *testing.T) {
+	policy := mdm.NewPolicy(map[string]any{
+		mdm.KeyRemoteJobsAllowed:   false,
+		mdm.KeyEnableLocalMetrics:  true,
+		mdm.KeyLocalMetricsAddress: "127.0.0.1:9999",
+	})
+	sameAddr := "127.0.0.1:9999"
+	otherAddr := "0.0.0.0:9999"
+	emptyAddr := ""
+
+	tests := []struct {
+		name  string
+		input ConfigInput
+		want  []string
+	}{
+		{name: "unset", input: ConfigInput{}, want: nil},
+		{name: "echo", input: ConfigInput{
+			RemoteJobsAllowed:   boolPtr(false),
+			LocalMetricsEnabled: boolPtr(true),
+			LocalMetricsAddress: &sameAddr,
+		}, want: nil},
+		{name: "remote jobs divergent", input: ConfigInput{RemoteJobsAllowed: boolPtr(true)}, want: []string{mdm.KeyRemoteJobsAllowed}},
+		{name: "metrics disabled", input: ConfigInput{LocalMetricsEnabled: boolPtr(false)}, want: []string{mdm.KeyEnableLocalMetrics}},
+		{name: "metrics address divergent", input: ConfigInput{LocalMetricsAddress: &otherAddr}, want: []string{mdm.KeyLocalMetricsAddress}},
+		{name: "metrics address explicit empty", input: ConfigInput{LocalMetricsAddress: &emptyAddr}, want: []string{mdm.KeyLocalMetricsAddress}},
+		{name: "all divergent", input: ConfigInput{
+			RemoteJobsAllowed:   boolPtr(true),
+			LocalMetricsEnabled: boolPtr(false),
+			LocalMetricsAddress: &otherAddr,
+		}, want: []string{mdm.KeyRemoteJobsAllowed, mdm.KeyEnableLocalMetrics, mdm.KeyLocalMetricsAddress}},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			assert.Equal(t, tc.want, MDMConflicts(tc.input, policy))
+		})
+	}
+}
+
 func boolPtr(b bool) *bool { return &b }
diff --git a/client/internal/profilemanager/invoking_user.go b/client/internal/profilemanager/invoking_user.go
index c86a6ce43..7ba612ffb 100644
--- a/client/internal/profilemanager/invoking_user.go
+++ b/client/internal/profilemanager/invoking_user.go
@@ -6,6 +6,7 @@ import (
 	"os/user"
 	"path/filepath"
 	"runtime"
+	"strconv"
 
 	log "github.com/sirupsen/logrus"
 )
@@ -13,17 +14,21 @@ import (
 const envSudoUser = "SUDO_USER"
 
 var (
-	geteuid    = os.Geteuid
-	lookupUser = user.Lookup
+	currentUser = user.Current
+	getegid     = os.Getegid
+	geteuid     = os.Geteuid
+	lookupUser  = user.Lookup
 )
 
 // InvokingUser returns the user a CLI invocation acts for. Under sudo that is
 // the user who ran sudo, not root: privileged flags force commands through
 // sudo, and resolving profiles as root would silently switch the daemon to
-// root's (default) profile instead of the invoking user's. Privilege decisions
-// are not made here — those stay on the kernel credentials of the daemon
-// connection, which SUDO_USER (a plain environment variable) can never
-// influence; a forged value only selects a profile root could select anyway.
+// root's (default) profile instead of the invoking user's. An unmapped positive
+// process UID uses its numeric kernel identity; root, sudo lookup failures, and
+// unavailable platform identities still fail closed. Privilege decisions stay
+// on the kernel credentials of the daemon connection, which SUDO_USER (a plain
+// environment variable) can never influence; a forged value only selects a
+// profile root could select anyway.
 func InvokingUser() (*user.User, error) {
 	if u, ok := sudoInvokingUser(); ok {
 		return u, nil
@@ -35,7 +40,23 @@ func InvokingUser() (*user.User, error) {
 	if sudoActive() {
 		return nil, fmt.Errorf("resolve sudo invoking user %q: refusing to fall back to root", os.Getenv(envSudoUser))
 	}
-	return user.Current()
+	u, err := currentUser()
+	if err == nil {
+		return u, nil
+	}
+
+	uid := geteuid()
+	if uid <= 0 {
+		return nil, err
+	}
+
+	log.Debugf("current user lookup for UID %d: %v; using numeric UID", uid, err)
+	uidString := strconv.Itoa(uid)
+	return &user.User{
+		Username: uidString,
+		Uid:      uidString,
+		Gid:      strconv.Itoa(getegid()),
+	}, nil
 }
 
 // IsPlainRoot reports that the process runs as root with no usable sudo
diff --git a/client/internal/profilemanager/invoking_user_test.go b/client/internal/profilemanager/invoking_user_test.go
index 54c8ad8fd..159d2616b 100644
--- a/client/internal/profilemanager/invoking_user_test.go
+++ b/client/internal/profilemanager/invoking_user_test.go
@@ -2,6 +2,7 @@ package profilemanager
 
 import (
 	"errors"
+	"fmt"
 	"io/fs"
 	"os"
 	"os/user"
@@ -21,7 +22,51 @@ func TestInvokingUserFallsBackToProcessUser(t *testing.T) {
 
 	current, err := user.Current()
 	require.NoError(t, err)
-	assert.Equal(t, current.Username, got.Username)
+	assert.Equal(t, current.Username, got.Username, "invoking user should match the process user without sudo")
+}
+
+func TestInvokingUserFailsClosedWithoutPositiveUID(t *testing.T) {
+	for _, uid := range []int{0, -1} {
+		t.Run(fmt.Sprintf("UID%d", uid), func(t *testing.T) {
+			t.Setenv(envSudoUser, "")
+			lookupErr := errors.New("current user unavailable")
+			fakeUnmappedUser(t, uid, 0, lookupErr)
+
+			got, err := InvokingUser()
+			require.ErrorIs(t, err, lookupErr)
+			assert.Nil(t, got, "root or unavailable UID must not become a synthetic identity")
+		})
+	}
+}
+
+func TestProfileFilePathUsesNumericIdentityForUnmappedNonRoot(t *testing.T) {
+	t.Setenv(envSudoUser, "")
+	fakeUnmappedUser(t, 1001230000, 0, errors.New("user: unknown userid 1001230000"))
+
+	profilesRoot := t.TempDir()
+	origDir := DefaultConfigPathDir
+	origOverride := ConfigDirOverride
+	DefaultConfigPathDir = profilesRoot
+	ConfigDirOverride = ""
+	t.Cleanup(func() {
+		DefaultConfigPathDir = origDir
+		ConfigDirOverride = origOverride
+	})
+
+	profileID := ID("0123456789abcdef0123456789abcdef")
+	got, err := (&Profile{ID: profileID}).FilePath()
+	require.NoError(t, err)
+	assert.Equal(t,
+		filepath.Join(profilesRoot, "1001230000", profileID.String()+".json"),
+		got,
+		"profile path should use the numeric UID namespace",
+	)
+
+	entries, err := os.ReadDir(profilesRoot)
+	require.NoError(t, err)
+	require.Len(t, entries, 1, "only the numeric UID directory should be created")
+	assert.Equal(t, "1001230000", entries[0].Name(), "profile namespace should be numeric")
+	assert.True(t, entries[0].IsDir(), "profile namespace should be a directory")
 }
 
 func TestSudoInvokingUserInactiveWithoutSudoContext(t *testing.T) {
@@ -60,6 +105,13 @@ func TestInvokingUserFailsClosedWhenSudoLookupFails(t *testing.T) {
 	fakeSudo(t, filepath.Join("/home", "misha"))
 	lookupUser = func(string) (*user.User, error) { return nil, errors.New("nss unavailable") }
 
+	origCurrentUser := currentUser
+	currentUser = func() (*user.User, error) {
+		t.Fatal("currentUser must not be called after a sudo lookup failure")
+		return nil, errors.New("currentUser called unexpectedly")
+	}
+	t.Cleanup(func() { currentUser = origCurrentUser })
+
 	got, err := InvokingUser()
 	require.Error(t, err)
 	assert.Nil(t, got, "must not resolve to the root process user")
@@ -215,6 +267,22 @@ func fakeSudo(t *testing.T, home string) {
 	})
 }
 
+func fakeUnmappedUser(t *testing.T, uid, gid int, lookupErr error) {
+	t.Helper()
+
+	origCurrentUser := currentUser
+	origEuid := geteuid
+	origEgid := getegid
+	currentUser = func() (*user.User, error) { return nil, lookupErr }
+	geteuid = func() int { return uid }
+	getegid = func() int { return gid }
+	t.Cleanup(func() {
+		currentUser = origCurrentUser
+		geteuid = origEuid
+		getegid = origEgid
+	})
+}
+
 func assertNoEntries(t *testing.T, root string) {
 	t.Helper()
 	err := filepath.WalkDir(root, func(path string, _ fs.DirEntry, err error) error {
diff --git a/client/ios/NetBirdSDK/client.go b/client/ios/NetBirdSDK/client.go
index bbbb969c9..96c747ae4 100644
--- a/client/ios/NetBirdSDK/client.go
+++ b/client/ios/NetBirdSDK/client.go
@@ -88,9 +88,15 @@ type Client struct {
 	// netMgr outlives engine restarts: it mirrors the OS connectivity, not
 	// the engine lifecycle. Run injects its state and sweeper into each new
 	// ConnectClient.
-	netMgr *netevents.Manager
-	// preloadedConfig holds config loaded from JSON (used on tvOS where file writes are blocked)
-	preloadedConfig *profilemanager.Config
+	netMgr              *netevents.Manager
+	preloadedConfigJSON atomic.Pointer[string]
+
+	// mdmSource holds the per-Client MDM policy source and its change
+	// detector as one unit. Set by SetMDMPolicyFetcher (called from the
+	// Swift side at extension init). Each Run passes the loader to the
+	// resolved Config so applyMDMPolicy picks up the active overlay. Nil
+	// means "MDM enforcement off for this Client".
+	mdmSource atomic.Pointer[mdmSource]
 
 	// stateMu guards the run lifecycle as one unit: the cancel installed by
 	// the current run, the channel it closes on exit, and the state it
@@ -122,44 +128,44 @@ func NewClient(cfgFile, stateFile, cacheDir, logFilePath, deviceName string, osV
 	}
 }
 
-// SetConfigFromJSON loads config from a JSON string into memory.
-// This is used on tvOS where file writes to App Group containers are blocked.
-// When set, IsLoginRequired() and Run() will use this preloaded config instead of reading from file.
+// SetConfigFromJSON stores the JSON config that later loads resolve instead of the config file (tvOS).
 func (c *Client) SetConfigFromJSON(jsonStr string) error {
-	cfg, err := profilemanager.ConfigFromJSON(jsonStr)
-	if err != nil {
+	if _, err := profilemanager.ConfigFromJSON(jsonStr); err != nil {
 		log.Errorf("SetConfigFromJSON: failed to parse config JSON: %v", err)
 		return err
 	}
-	c.preloadedConfig = cfg
+	c.preloadedConfigJSON.Store(&jsonStr)
 	log.Infof("SetConfigFromJSON: config loaded successfully from JSON")
 	return nil
 }
 
+func (c *Client) loadConfig(input profilemanager.ConfigInput) (*profilemanager.Config, error) {
+	var cfg *profilemanager.Config
+	var err error
+	if preloaded := c.preloadedConfigJSON.Load(); preloaded != nil {
+		cfg, err = profilemanager.ConfigFromJSON(*preloaded)
+	} else {
+		cfg, err = profilemanager.DirectUpdateOrCreateConfig(input)
+	}
+	if err != nil {
+		return nil, err
+	}
+	c.applyMDMOverlay(cfg)
+	return cfg, nil
+}
+
 // Run start the internal client. It is a blocker function
 func (c *Client) Run(fd int32, interfaceName string, envList *EnvList) error {
 	exportEnvList(envList)
 	log.Infof("Starting NetBird client")
 	log.Debugf("Tunnel uses interface: %s", interfaceName)
 
-	var cfg *profilemanager.Config
-	var err error
-
-	// Use preloaded config if available (tvOS where file writes are blocked)
-	if c.preloadedConfig != nil {
-		log.Infof("Run: using preloaded config from memory")
-		cfg = c.preloadedConfig
-	} else {
-		log.Infof("Run: loading config from file")
-		// Use DirectUpdateOrCreateConfig to avoid atomic file operations (temp file + rename)
-		// which are blocked by the tvOS sandbox in App Group containers
-		cfg, err = profilemanager.DirectUpdateOrCreateConfig(profilemanager.ConfigInput{
-			ConfigPath:    c.cfgFile,
-			StateFilePath: c.stateFile,
-		})
-		if err != nil {
-			return err
-		}
+	cfg, err := c.loadConfig(profilemanager.ConfigInput{
+		ConfigPath:    c.cfgFile,
+		StateFilePath: c.stateFile,
+	})
+	if err != nil {
+		return err
 	}
 	c.recorder.UpdateManagementAddress(cfg.ManagementURL.String())
 	c.recorder.UpdateRosenpass(cfg.RosenpassEnabled, cfg.RosenpassPermissive)
@@ -274,19 +280,13 @@ func (c *Client) DebugBundle(anonymize bool, anonymizeLevel string) (string, err
 
 	// If the engine hasn't been started, load config so we can reach management.
 	if cfg == nil {
-		if c.preloadedConfig != nil {
-			cfg = c.preloadedConfig
-		} else {
-			var err error
-			// Use DirectUpdateOrCreateConfig to avoid atomic file operations
-			// (temp file + rename) blocked by the tvOS sandbox.
-			cfg, err = profilemanager.DirectUpdateOrCreateConfig(profilemanager.ConfigInput{
-				ConfigPath:    c.cfgFile,
-				StateFilePath: c.stateFile,
-			})
-			if err != nil {
-				return "", fmt.Errorf("load config: %w", err)
-			}
+		var err error
+		cfg, err = c.loadConfig(profilemanager.ConfigInput{
+			ConfigPath:    c.cfgFile,
+			StateFilePath: c.stateFile,
+		})
+		if err != nil {
+			return "", fmt.Errorf("load config: %w", err)
 		}
 	}
 
@@ -421,29 +421,9 @@ func (c *Client) IsLoginRequired() bool {
 	ctx, cancel := context.WithCancel(ctxWithValues)
 	defer cancel()
 
-	var cfg *profilemanager.Config
-	var err error
-
-	// Use preloaded config if available (tvOS where file writes are blocked)
-	if c.preloadedConfig != nil {
-		log.Infof("IsLoginRequired: using preloaded config from memory")
-		cfg = c.preloadedConfig
-	} else {
-		log.Infof("IsLoginRequired: loading config from file")
-		// Use DirectUpdateOrCreateConfig to avoid atomic file operations (temp file + rename)
-		// which are blocked by the tvOS sandbox in App Group containers
-		cfg, err = profilemanager.DirectUpdateOrCreateConfig(profilemanager.ConfigInput{
-			ConfigPath: c.cfgFile,
-		})
-		if err != nil {
-			log.Errorf("IsLoginRequired: failed to load config: %v", err)
-			// If we can't load config, assume login is required
-			return true
-		}
-	}
-
-	if cfg == nil {
-		log.Errorf("IsLoginRequired: config is nil")
+	cfg, err := c.loadConfig(profilemanager.ConfigInput{ConfigPath: c.cfgFile})
+	if err != nil {
+		log.Errorf("IsLoginRequired: failed to load config: %v", err)
 		return true
 	}
 
@@ -493,6 +473,7 @@ func (c *Client) LoginForMobile() string {
 		log.Errorf("LoginForMobile: failed to load config: %v", err)
 		return fmt.Sprintf("failed to load config: %v", err)
 	}
+	c.applyMDMOverlay(cfg)
 
 	oAuthFlow, err := auth.NewOAuthFlow(ctx, cfg, false, false, "")
 	if err != nil {
diff --git a/client/ios/NetBirdSDK/login.go b/client/ios/NetBirdSDK/login.go
index cf7aa6730..0dfff620e 100644
--- a/client/ios/NetBirdSDK/login.go
+++ b/client/ios/NetBirdSDK/login.go
@@ -11,6 +11,7 @@ import (
 
 	"github.com/netbirdio/netbird/client/internal/auth"
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
+	"github.com/netbirdio/netbird/client/mdm"
 	"github.com/netbirdio/netbird/client/mobile"
 	"github.com/netbirdio/netbird/client/system"
 )
@@ -39,14 +40,22 @@ type Auth struct {
 	ctx     context.Context
 	cancel  context.CancelFunc
 	config  *profilemanager.Config
+	base    *profilemanager.Config
+	policy  *mdm.Policy
 	cfgPath string
 }
 
-// NewAuth instantiate Auth struct and validate the management URL
-func NewAuth(cfgPath string, mgmURL string) (*Auth, error) {
-	inputCfg := profilemanager.ConfigInput{
-		ConfigPath:    cfgPath,
-		ManagementURL: mgmURL,
+// NewAuth instantiate Auth struct and validate the management URL.
+// Auth is constructed under the active MDM policy: the policy is overlaid on
+// the resolved config so the login runs against the enforced values, while
+// the persisted config keeps the caller-supplied ones; a caller-supplied
+// management URL is ignored while MDM manages that key. A nil fetcher
+// disables MDM enforcement.
+func NewAuth(cfgPath string, mgmURL string, fetcher PolicyFetcher) (*Auth, error) {
+	policy := loaderFor(fetcher).Load()
+	inputCfg := profilemanager.ConfigInput{ConfigPath: cfgPath}
+	if _, managed := policy.GetString(mdm.KeyManagementURL); !managed {
+		inputCfg.ManagementURL = mgmURL
 	}
 
 	// Load the existing config when a config file is already present so an
@@ -67,6 +76,10 @@ func NewAuth(cfgPath string, mgmURL string) (*Auth, error) {
 	if err != nil {
 		return nil, err
 	}
+	a := &Auth{policy: policy, cfgPath: cfgPath}
+	if err := a.setBaseConfig(cfg); err != nil {
+		return nil, err
+	}
 
 	// Use a cancellable context so Stop() can abort an in-progress interactive
 	// login. The PKCE flow's WaitToken blocks (and keeps its loopback HTTP server
@@ -76,14 +89,8 @@ func NewAuth(cfgPath string, mgmURL string) (*Auth, error) {
 	// process (decoupled from the network extension), so without this the server
 	// lingers after the user dismisses the browser and the next connect stalls
 	// trying to bind the same port.
-	ctx, cancel := context.WithCancel(context.Background())
-
-	return &Auth{
-		ctx:     ctx,
-		cancel:  cancel,
-		config:  cfg,
-		cfgPath: cfgPath,
-	}, nil
+	a.ctx, a.cancel = context.WithCancel(context.Background())
+	return a, nil
 }
 
 // NewAuthWithConfig instantiate Auth based on existing config
@@ -106,9 +113,7 @@ func (a *Auth) Stop() {
 	}
 }
 
-// SaveConfigIfSSOSupported test the connectivity with the management server by retrieving the server device flow info.
-// If it returns a flow info than save the configuration and return true. If it gets a codes.NotFound, it means that SSO
-// is not supported and returns false without saving the configuration. For other errors return false.
+// SaveConfigIfSSOSupported reports whether the management server supports SSO; the config is already persisted by NewAuth.
 func (a *Auth) SaveConfigIfSSOSupported(listener SSOListener) {
 	if listener == nil {
 		log.Errorf("SaveConfigIfSSOSupported: listener is nil")
@@ -136,17 +141,10 @@ func (a *Auth) saveConfigIfSSOSupported() (bool, error) {
 		return false, fmt.Errorf("failed to check SSO support: %v", err)
 	}
 
-	if !supportsSSO {
-		return false, nil
-	}
-
-	// Use DirectWriteOutConfig to avoid atomic file operations (temp file + rename)
-	// which are blocked by the tvOS sandbox in App Group containers
-	err = profilemanager.DirectWriteOutConfig(a.cfgPath, a.config)
-	return true, err
+	return supportsSSO, nil
 }
 
-// LoginWithSetupKeyAndSaveConfig test the connectivity with the management server with the setup key.
+// LoginWithSetupKeyAndSaveConfig registers the peer with the setup key; the config is already persisted by NewAuth.
 func (a *Auth) LoginWithSetupKeyAndSaveConfig(resultListener ErrListener, setupKey string, deviceName string) {
 	if resultListener == nil {
 		log.Errorf("LoginWithSetupKeyAndSaveConfig: resultListener is nil")
@@ -175,10 +173,7 @@ func (a *Auth) loginWithSetupKeyAndSaveConfig(setupKey string, deviceName string
 	if err != nil {
 		return fmt.Errorf("login failed: %v", err)
 	}
-
-	// Use DirectWriteOutConfig to avoid atomic file operations (temp file + rename)
-	// which are blocked by the tvOS sandbox in App Group containers
-	return profilemanager.DirectWriteOutConfig(a.cfgPath, a.config)
+	return nil
 }
 
 // LoginSync performs a synchronous login check without UI interaction
@@ -312,19 +307,6 @@ func (a *Auth) login(urlOpener URLOpener, forceDeviceAuth bool, deviceName strin
 		}
 	}
 
-	// Save the config before notifying success to ensure persistence completes
-	// before the callback potentially triggers teardown on the Swift side.
-	// Note: This differs from Android which doesn't save config after login.
-	// On iOS/tvOS, we save here because:
-	// 1. The config may have been modified during login (e.g., new tokens)
-	// 2. On tvOS, the Network Extension context may be the only place with
-	//    write permissions to the App Group container
-	if a.cfgPath != "" {
-		if err := profilemanager.DirectWriteOutConfig(a.cfgPath, a.config); err != nil {
-			log.Warnf("failed to save config after login: %v", err)
-		}
-	}
-
 	// Notify caller of successful login synchronously before returning
 	urlOpener.OnLoginSuccess()
 
@@ -375,23 +357,44 @@ func (a *Auth) foregroundGetTokenInfo(authClient *auth.Auth, urlOpener URLOpener
 	return &tokenInfo, nil
 }
 
-// GetConfigJSON returns the current config as a JSON string.
-// This can be used by the caller to persist the config via alternative storage
-// mechanisms (e.g., UserDefaults on tvOS where file writes are blocked).
+// GetConfigJSON returns the config without the MDM overlay as JSON, for persisting it outside the config file (tvOS).
 func (a *Auth) GetConfigJSON() (string, error) {
-	if a.config == nil {
+	cfg := a.base
+	if cfg == nil {
+		cfg = a.config
+	}
+	if cfg == nil {
 		return "", fmt.Errorf("no config available")
 	}
-	return profilemanager.ConfigToJSON(a.config)
+	return profilemanager.ConfigToJSON(cfg)
 }
 
-// SetConfigFromJSON loads config from a JSON string.
-// This can be used to restore config from alternative storage mechanisms.
+// SetConfigFromJSON replaces the config from JSON; the MDM overlay is applied on top for the login.
 func (a *Auth) SetConfigFromJSON(jsonStr string) error {
 	cfg, err := profilemanager.ConfigFromJSON(jsonStr)
 	if err != nil {
 		return err
 	}
-	a.config = cfg
+	return a.setBaseConfig(cfg)
+}
+
+func (a *Auth) setBaseConfig(base *profilemanager.Config) error {
+	overlaid, err := copyConfig(base)
+	if err != nil {
+		return err
+	}
+	if a.policy != nil {
+		overlaid.ApplyMDMPolicy(a.policy)
+	}
+	a.base = base
+	a.config = overlaid
 	return nil
 }
+
+func copyConfig(cfg *profilemanager.Config) (*profilemanager.Config, error) {
+	raw, err := profilemanager.ConfigToJSON(cfg)
+	if err != nil {
+		return nil, err
+	}
+	return profilemanager.ConfigFromJSON(raw)
+}
diff --git a/client/ios/NetBirdSDK/mdm.go b/client/ios/NetBirdSDK/mdm.go
new file mode 100644
index 000000000..93a31916c
--- /dev/null
+++ b/client/ios/NetBirdSDK/mdm.go
@@ -0,0 +1,66 @@
+//go:build ios
+
+package NetBirdSDK
+
+import (
+	"github.com/netbirdio/netbird/client/internal/profilemanager"
+	"github.com/netbirdio/netbird/client/mdm"
+)
+
+// PolicyFetcher is implemented by the native layer to return the current
+// managed configuration as a JSON-encoded object string; "" means no MDM
+// source is present.
+type PolicyFetcher interface {
+	FetchJSON() string
+}
+
+type mdmSource struct {
+	loader   *mdm.Loader
+	detector *mdm.ChangeDetector
+}
+
+// SetMDMPolicyFetcher registers the native-provided MDM policy fetcher on
+// this Client; passing nil disables MDM enforcement.
+func (c *Client) SetMDMPolicyFetcher(p PolicyFetcher) {
+	loader := loaderFor(p)
+	c.mdmSource.Store(&mdmSource{loader: loader, detector: mdm.NewChangeDetector(loader)})
+}
+
+// HasMDMPolicyChanged re-reads the managed configuration and reports whether
+// it changed since the last observation; call it from the native OS-change
+// notification and restart the engine only on true.
+func (c *Client) HasMDMPolicyChanged() bool {
+	src := c.mdmSource.Load()
+	if src == nil {
+		return false
+	}
+	return src.detector.Changed()
+}
+
+// GetRestrictionsJSON returns the UI enforcement snapshot derived from the
+// active MDM policy, in the JSON shape shared with the desktop frontend.
+func (c *Client) GetRestrictionsJSON() (string, error) {
+	return mdm.BuildRestrictions(c.mdmLoader().Load()).JSON()
+}
+
+func (c *Client) applyMDMOverlay(cfg *profilemanager.Config) {
+	loader := c.mdmLoader()
+	if cfg == nil || loader == nil {
+		return
+	}
+	cfg.ApplyMDMPolicy(loader.Load())
+}
+
+func (c *Client) mdmLoader() *mdm.Loader {
+	if src := c.mdmSource.Load(); src != nil {
+		return src.loader
+	}
+	return nil
+}
+
+func loaderFor(p PolicyFetcher) *mdm.Loader {
+	if p == nil {
+		return mdm.NewJSONLoader(nil)
+	}
+	return mdm.NewJSONLoader(p.FetchJSON)
+}
diff --git a/client/ios/NetBirdSDK/preferences.go b/client/ios/NetBirdSDK/preferences.go
index 39aa7ed83..5297920a3 100644
--- a/client/ios/NetBirdSDK/preferences.go
+++ b/client/ios/NetBirdSDK/preferences.go
@@ -3,12 +3,16 @@
 package NetBirdSDK
 
 import (
+	"sync/atomic"
+
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
+	"github.com/netbirdio/netbird/client/mdm"
 )
 
 // Preferences export a subset of the internal config for gomobile
 type Preferences struct {
 	configInput profilemanager.ConfigInput
+	mdmLoader   atomic.Pointer[mdm.Loader]
 }
 
 // NewPreferences create new Preferences instance
@@ -17,11 +21,30 @@ func NewPreferences(configPath string, stateFilePath string) *Preferences {
 		ConfigPath:    configPath,
 		StateFilePath: stateFilePath,
 	}
-	return &Preferences{ci}
+	return &Preferences{configInput: ci}
+}
+
+// SetMDMPolicyFetcher registers the native-provided MDM policy fetcher on
+// this Preferences instance; passing nil disables MDM enforcement.
+func (p *Preferences) SetMDMPolicyFetcher(f PolicyFetcher) {
+	p.mdmLoader.Store(loaderFor(f))
+}
+
+// GetRestrictionsJSON returns the UI enforcement snapshot derived from the
+// active MDM policy, in the JSON shape shared with the desktop frontend.
+func (p *Preferences) GetRestrictionsJSON() (string, error) {
+	return mdm.BuildRestrictions(p.policy()).JSON()
+}
+
+func (p *Preferences) policy() *mdm.Policy {
+	return p.mdmLoader.Load().Load()
 }
 
 // GetManagementURL read url from config file
 func (p *Preferences) GetManagementURL() (string, error) {
+	if v, ok := p.policy().GetString(mdm.KeyManagementURL); ok {
+		return mdm.CanonicalURL(v), nil
+	}
 	if p.configInput.ManagementURL != "" {
 		return p.configInput.ManagementURL, nil
 	}
@@ -30,7 +53,7 @@ func (p *Preferences) GetManagementURL() (string, error) {
 	if err != nil {
 		return "", err
 	}
-	return cfg.ManagementURL.String(), err
+	return cfg.ManagementURL.String(), nil
 }
 
 // SetManagementURL store the given url and wait for commit
@@ -56,17 +79,21 @@ func (p *Preferences) SetAdminURL(url string) {
 	p.configInput.AdminURL = url
 }
 
-// GetPreSharedKey read preshared key from config file
-func (p *Preferences) GetPreSharedKey() (string, error) {
+// HasPreSharedKey reports whether a pre-shared key is staged, persisted, or
+// enforced by MDM; the key itself is never handed to the native layer.
+func (p *Preferences) HasPreSharedKey() (bool, error) {
+	if _, ok := p.policy().GetString(mdm.KeyPreSharedKey); ok {
+		return true, nil
+	}
 	if p.configInput.PreSharedKey != nil {
-		return *p.configInput.PreSharedKey, nil
+		return *p.configInput.PreSharedKey != "", nil
 	}
 
 	cfg, err := profilemanager.ReadConfig(p.configInput.ConfigPath)
 	if err != nil {
-		return "", err
+		return false, err
 	}
-	return cfg.PreSharedKey, err
+	return cfg.PreSharedKey != "", nil
 }
 
 // SetPreSharedKey store the given key and wait for commit
@@ -81,6 +108,9 @@ func (p *Preferences) SetRosenpassEnabled(enabled bool) {
 
 // GetRosenpassEnabled read rosenpass enabled from config file
 func (p *Preferences) GetRosenpassEnabled() (bool, error) {
+	if v, ok := p.policy().GetBool(mdm.KeyRosenpassEnabled); ok {
+		return v, nil
+	}
 	if p.configInput.RosenpassEnabled != nil {
 		return *p.configInput.RosenpassEnabled, nil
 	}
@@ -99,6 +129,9 @@ func (p *Preferences) SetRosenpassPermissive(permissive bool) {
 
 // GetRosenpassPermissive read rosenpass permissive from config file
 func (p *Preferences) GetRosenpassPermissive() (bool, error) {
+	if v, ok := p.policy().GetBool(mdm.KeyRosenpassPermissive); ok {
+		return v, nil
+	}
 	if p.configInput.RosenpassPermissive != nil {
 		return *p.configInput.RosenpassPermissive, nil
 	}
@@ -130,7 +163,8 @@ func (p *Preferences) SetDisableIPv6(disable bool) {
 
 // GetRemoteJobsAllowed reads the remote jobs opt-in from config file
 func (p *Preferences) GetRemoteJobsAllowed() (bool, error) {
-	if p.configInput.RemoteJobsAllowed != nil {
+	policy := p.policy()
+	if !policy.HasKey(mdm.KeyRemoteJobsAllowed) && p.configInput.RemoteJobsAllowed != nil {
 		return *p.configInput.RemoteJobsAllowed, nil
 	}
 
@@ -138,10 +172,11 @@ func (p *Preferences) GetRemoteJobsAllowed() (bool, error) {
 	if err != nil {
 		return false, err
 	}
+	cfg.ApplyMDMPolicy(policy)
 	if cfg.RemoteJobsAllowed == nil {
 		return false, nil
 	}
-	return *cfg.RemoteJobsAllowed, err
+	return *cfg.RemoteJobsAllowed, nil
 }
 
 // SetRemoteJobsAllowed stores the given value and waits for commit
@@ -151,6 +186,9 @@ func (p *Preferences) SetRemoteJobsAllowed(allowed bool) {
 
 // Commit write out the changes into config file
 func (p *Preferences) Commit() error {
+	if err := profilemanager.CheckMDMConflicts(p.configInput, p.policy()); err != nil {
+		return err
+	}
 	// Use DirectUpdateOrCreateConfig to avoid atomic file operations (temp file + rename)
 	// which are blocked by the tvOS sandbox in App Group containers
 	_, err := profilemanager.DirectUpdateOrCreateConfig(p.configInput)
diff --git a/client/ios/NetBirdSDK/preferences_test.go b/client/ios/NetBirdSDK/preferences_test.go
index 5f75e7c9a..2382e123c 100644
--- a/client/ios/NetBirdSDK/preferences_test.go
+++ b/client/ios/NetBirdSDK/preferences_test.go
@@ -31,14 +31,13 @@ func TestPreferences_DefaultValues(t *testing.T) {
 		t.Errorf("invalid default management url: %s", defaultVar)
 	}
 
-	var preSharedKey string
-	preSharedKey, err = p.GetPreSharedKey()
+	hasPSK, err := p.HasPreSharedKey()
 	if err != nil {
-		t.Fatalf("failed to read default preshared key: %s", err)
+		t.Fatalf("failed to read default preshared key presence: %s", err)
 	}
 
-	if preSharedKey != "" {
-		t.Errorf("invalid preshared key: %s", preSharedKey)
+	if hasPSK {
+		t.Errorf("unexpected preshared key presence on fresh config")
 	}
 }
 
@@ -69,13 +68,13 @@ func TestPreferences_ReadUncommitedValues(t *testing.T) {
 	}
 
 	p.SetPreSharedKey(exampleString)
-	resp, err = p.GetPreSharedKey()
+	hasPSK, err := p.HasPreSharedKey()
 	if err != nil {
-		t.Fatalf("failed to read preshared key: %s", err)
+		t.Fatalf("failed to read preshared key presence: %s", err)
 	}
 
-	if resp != exampleString {
-		t.Errorf("unexpected preshared key: %s", resp)
+	if !hasPSK {
+		t.Errorf("expected preshared key presence after staging one")
 	}
 }
 
@@ -114,12 +113,12 @@ func TestPreferences_Commit(t *testing.T) {
 		t.Errorf("unexpected management url: %s", resp)
 	}
 
-	resp, err = p.GetPreSharedKey()
+	hasPSK, err := p.HasPreSharedKey()
 	if err != nil {
-		t.Fatalf("failed to read preshared key: %s", err)
+		t.Fatalf("failed to read preshared key presence: %s", err)
 	}
 
-	if resp != examplePresharedKey {
-		t.Errorf("unexpected preshared key: %s", resp)
+	if !hasPSK {
+		t.Errorf("expected preshared key presence after commit")
 	}
 }
diff --git a/client/ios/NetBirdSDK/profile_manager.go b/client/ios/NetBirdSDK/profile_manager.go
index 139521c7f..df962e227 100644
--- a/client/ios/NetBirdSDK/profile_manager.go
+++ b/client/ios/NetBirdSDK/profile_manager.go
@@ -52,6 +52,12 @@ func NewProfileManager(configDir string) *ProfileManager {
 	return &ProfileManager{impl: mobile.NewProfileManager(configDir, iosUsername)}
 }
 
+// SetMDMPolicyFetcher registers the native-provided MDM policy fetcher on
+// this ProfileManager; passing nil disables MDM enforcement.
+func (pm *ProfileManager) SetMDMPolicyFetcher(f PolicyFetcher) {
+	pm.impl.SetMDMLoader(loaderFor(f))
+}
+
 // ListProfiles returns all available profiles, including the default profile,
 // with their active status set.
 func (pm *ProfileManager) ListProfiles() (*ProfileArray, error) {
diff --git a/client/mdm/changedetector.go b/client/mdm/changedetector.go
new file mode 100644
index 000000000..5c21ae355
--- /dev/null
+++ b/client/mdm/changedetector.go
@@ -0,0 +1,34 @@
+package mdm
+
+import "sync"
+
+// ChangeDetector tracks the last observed policy of a Loader so an
+// OS-notification-driven caller can ask whether the managed configuration
+// actually changed before restarting anything.
+type ChangeDetector struct {
+	mu     sync.Mutex
+	loader *Loader
+	prev   *Policy
+}
+
+// NewChangeDetector constructs a ChangeDetector seeded with the loader's
+// current policy, so only a later change reports as changed.
+func NewChangeDetector(loader *Loader) *ChangeDetector {
+	return &ChangeDetector{
+		loader: loader,
+		prev:   loader.Load(),
+	}
+}
+
+// Changed re-reads the policy, logs the per-key diff, and reports whether it
+// diverged from the last observation; the new snapshot becomes the baseline.
+func (d *ChangeDetector) Changed() bool {
+	d.mu.Lock()
+	defer d.mu.Unlock()
+	curr := d.loader.Load()
+	if !policyChanged(d.prev, curr) {
+		return false
+	}
+	d.prev = curr
+	return true
+}
diff --git a/client/mdm/conflicts.go b/client/mdm/conflicts.go
new file mode 100644
index 000000000..160212afb
--- /dev/null
+++ b/client/mdm/conflicts.go
@@ -0,0 +1,116 @@
+package mdm
+
+import (
+	"net/url"
+
+	"github.com/netbirdio/netbird/util"
+)
+
+// PreSharedKeyRedactedSentinel is the redaction mask returned in place of a
+// real pre-shared key; an incoming value equal to it is a round-trip echo,
+// never an override.
+const PreSharedKeyRedactedSentinel = "**********"
+
+// ConflictCheck is a value-aware comparison between a single requested field
+// and the corresponding MDM-enforced value.
+type ConflictCheck struct {
+	Key   string
+	Check func(*Policy) bool
+}
+
+// ConflictBool builds a ConflictCheck for a boolean MDM key.
+func ConflictBool(key string, p *bool) ConflictCheck {
+	return ConflictCheck{
+		Key: key,
+		Check: func(pol *Policy) bool {
+			if p == nil {
+				return true
+			}
+			want, ok := pol.GetBool(key)
+			return ok && want == *p
+		},
+	}
+}
+
+// ConflictStringPtr builds a ConflictCheck for an optional string MDM key,
+// where an explicit empty value is still a request to change the setting. A
+// nil p means "field not set" (no override requested).
+func ConflictStringPtr(key string, p *string) ConflictCheck {
+	return ConflictCheck{
+		Key: key,
+		Check: func(pol *Policy) bool {
+			if p == nil {
+				return true
+			}
+			want, ok := pol.GetString(key)
+			return ok && want == *p
+		},
+	}
+}
+
+// ConflictURL builds a ConflictCheck for a URL-typed MDM key. The two sides are
+// compared as the endpoints they address, not as strings: see
+// util.SameServiceURL.
+func ConflictURL(key, got string) ConflictCheck {
+	return ConflictCheck{
+		Key: key,
+		Check: func(pol *Policy) bool {
+			if got == "" {
+				return true
+			}
+			want, ok := pol.GetString(key)
+			return ok && util.SameServiceURLStrings(want, got)
+		},
+	}
+}
+
+// ConflictInt64 builds a ConflictCheck for an integer MDM key.
+func ConflictInt64(key string, p *int64) ConflictCheck {
+	return ConflictCheck{
+		Key: key,
+		Check: func(pol *Policy) bool {
+			if p == nil {
+				return true
+			}
+			want, ok := pol.GetInt(key)
+			return ok && want == *p
+		},
+	}
+}
+
+// ResolveConflicts returns the names of keys whose requested value diverges
+// from the policy-enforced value; keys the policy does not manage are skipped,
+// a managed key without a Check counts as a conflict.
+func ResolveConflicts(policy *Policy, checks []ConflictCheck) []string {
+	if policy.IsEmpty() {
+		return nil
+	}
+	var conflicts []string
+	for _, c := range checks {
+		if !policy.HasKey(c.Key) {
+			continue
+		}
+		if c.Check == nil || !c.Check(policy) {
+			conflicts = append(conflicts, c.Key)
+		}
+	}
+	return conflicts
+}
+
+// CanonicalURL normalizes a service URL by appending the scheme default port
+// when none is present; unparseable input is returned unchanged.
+func CanonicalURL(s string) string {
+	u, err := url.ParseRequestURI(s)
+	if err != nil {
+		return s
+	}
+	if u.Port() == "" {
+		switch u.Scheme {
+		case "https":
+			u.Host += ":443"
+		case "http":
+			u.Host += ":80"
+		}
+	}
+	return u.String()
+}
diff --git a/client/mdm/conflicts_test.go b/client/mdm/conflicts_test.go
new file mode 100644
index 000000000..d145ec103
--- /dev/null
+++ b/client/mdm/conflicts_test.go
@@ -0,0 +1,40 @@
+package mdm
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// The same spellings, through the conflict check that decides whether a request
+// is refused. An enforced URL restated in another spelling addresses the very
+// server the policy names, so it must not be reported as a conflict.
+func TestConflictURLComparesEndpoints(t *testing.T) {
+	policy := NewPolicy(map[string]any{KeyManagementURL: "https://mgmt.example.com"})
+	require.True(t, policy.HasKey(KeyManagementURL))
+
+	for _, restated := range []string{
+		"https://mgmt.example.com",
+		"https://mgmt.example.com:443",
+		"https://mgmt.example.com/",
+		"https://MGMT.example.com",
+		"https://mgmt.example.com:0443",
+	} {
+		conflicts := ResolveConflicts(policy, []ConflictCheck{ConflictURL(KeyManagementURL, restated)})
+		assert.Empty(t, conflicts, "%q is the enforced endpoint written differently", restated)
+	}
+
+	for _, diverging := range []string{
+		"https://other.example.com",
+		"http://mgmt.example.com",
+		"https://mgmt.example.com:8443",
+		"https://mgmt.example.com/other",
+	} {
+		conflicts := ResolveConflicts(policy, []ConflictCheck{ConflictURL(KeyManagementURL, diverging)})
+		assert.Equal(t, []string{KeyManagementURL}, conflicts, "%q addresses another endpoint", diverging)
+	}
+
+	// An unset field is not a request to change anything.
+	assert.Empty(t, ResolveConflicts(policy, []ConflictCheck{ConflictURL(KeyManagementURL, "")}))
+}
diff --git a/client/mdm/jsonloader.go b/client/mdm/jsonloader.go
new file mode 100644
index 000000000..7139b0e4f
--- /dev/null
+++ b/client/mdm/jsonloader.go
@@ -0,0 +1,34 @@
+package mdm
+
+import (
+	"encoding/json"
+
+	log "github.com/sirupsen/logrus"
+)
+
+type jsonPolicyFetcher struct {
+	fetch func() string
+}
+
+// NewJSONLoader constructs a Loader whose policy source is a JSON-encoded
+// object string, as produced by the mobile native layers; a nil fetch
+// disables MDM enforcement.
+func NewJSONLoader(fetch func() string) *Loader {
+	if fetch == nil {
+		return NewLoader(nil)
+	}
+	return NewLoader(&jsonPolicyFetcher{fetch: fetch})
+}
+
+func (f *jsonPolicyFetcher) Fetch() map[string]any {
+	raw := f.fetch()
+	if raw == "" {
+		return nil
+	}
+	var out map[string]any
+	if err := json.Unmarshal([]byte(raw), &out); err != nil {
+		log.Warnf("MDM mobile fetcher: invalid JSON payload from native: %v", err)
+		return nil
+	}
+	return out
+}
diff --git a/client/mdm/policy.go b/client/mdm/policy.go
index dac135ea6..638fa0d80 100644
--- a/client/mdm/policy.go
+++ b/client/mdm/policy.go
@@ -119,16 +119,46 @@ func NewPolicy(values map[string]any) *Policy {
 	return &Policy{values: values}
 }
 
-// LoadPolicy reads the platform-native MDM configuration. Returns an
-// empty (but non-nil) Policy when no source is present, the source is
-// empty, or the platform is unsupported.
+// PolicyFetcher supplies the managed configuration to a Loader. Mobile
+// platforms (Android / iOS) implement it to push the OS-managed values
+// into the Go runtime. On every platform a non-nil fetcher takes
+// precedence over the native source, which is the test seam for the
+// registry / plist loaders; a nil fetcher leaves the native source in
+// charge, or disables MDM enforcement where there is none.
+type PolicyFetcher interface {
+	Fetch() map[string]any
+}
+
+// Loader is the DI-friendly entry point for reading the active MDM
+// policy. Construct one at the daemon's lifecycle owner (Server on
+// desktop, gomobile-exposed bridge on mobile) and pass it to anything
+// that needs to read MDM state (the reload ticker, profilemanager's
+// Config). Each callsite has the Loader handed in instead of looking
+// up package-level state.
+type Loader struct {
+	fetcher PolicyFetcher
+}
+
+// NewLoader constructs a Loader. A non-nil fetcher takes precedence over
+// the platform-native source; production desktop callers pass nil so the
+// registry / plist stays authoritative.
+func NewLoader(f PolicyFetcher) *Loader {
+	return &Loader{fetcher: f}
+}
+
+// Load reads the platform-native MDM configuration and returns a
+// Policy. Returns an empty (but non-nil) Policy when no source is
+// present, the source is empty, or the platform is unsupported.
 //
 // Diagnostic logging differentiates the three states:
 //   - source absent / unsupported platform: trace log only
 //   - source present, zero keys:             info "MDM enrolled (no managed keys)"
 //   - source present, N keys:                info "MDM enrolled with N managed keys: [...]"
-func LoadPolicy() *Policy {
-	values, err := loadPlatformPolicy()
+func (l *Loader) Load() *Policy {
+	if l == nil {
+		return &Policy{values: map[string]any{}}
+	}
+	values, err := l.loadPlatform()
 	if err != nil {
 		log.Tracef("MDM policy load: %v", err)
 		return &Policy{values: map[string]any{}}
@@ -205,6 +235,8 @@ func (p *Policy) GetBool(key string) (bool, bool) {
 		return t != 0, true
 	case int64:
 		return t != 0, true
+	case float64:
+		return t != 0, true
 	}
 	return false, false
 }
@@ -270,7 +302,7 @@ func (p *Policy) GetStringSlice(key string) ([]string, bool) {
 }
 
 // sortedKeys returns the keys of m as a deterministic, lexicographically
-// sorted slice. Used internally by Policy.ManagedKeys and LoadPolicy's
+// sorted slice. Used internally by Policy.ManagedKeys and Loader.Load's
 // diagnostic log line so callers see a stable key order across runs
 // regardless of Go's randomised map iteration.
 func sortedKeys(m map[string]any) []string {
diff --git a/client/mdm/policy_darwin.go b/client/mdm/policy_darwin.go
index 57aa1168c..4159f5b7e 100644
--- a/client/mdm/policy_darwin.go
+++ b/client/mdm/policy_darwin.go
@@ -25,8 +25,9 @@ import (
 // writable plist, as a defense against tampered installs.
 const policyPlistPath = "/Library/Managed Preferences/io.netbird.client.plist"
 
-// loadPlatformPolicy reads the MDM-managed configuration from the macOS
-// managed-preferences plist at policyPlistPath. Returns:
+// loadPlatform reads the MDM-managed configuration from the macOS
+// managed-preferences plist at policyPlistPath, unless a fetcher was
+// injected, in which case its values are returned instead. Returns:
 //   - (nil, nil)  when the plist is absent (device not MDM-enrolled for
 //     NetBird, or admin has not yet pushed a payload)
 //   - (map, nil)  with N entries when N managed values are present
@@ -39,13 +40,19 @@ const policyPlistPath = "/Library/Managed Preferences/io.netbird.client.plist"
 // skipped so a stray entry in the payload does not block startup.
 // Native plist value types map naturally onto the Policy accessor
 // expectations (GetString / GetBool / GetInt / GetStringSlice).
-func loadPlatformPolicy() (map[string]any, error) {
+func (l *Loader) loadPlatform() (map[string]any, error) {
+	// Honour the injected fetcher when present so tests (and any
+	// future non-macOS MDM channel) can short-circuit the plist read
+	// with a scripted policy.
+	if l != nil && l.fetcher != nil {
+		return l.fetcher.Fetch(), nil
+	}
 	f, err := os.Open(policyPlistPath)
 	if err != nil {
 		if errors.Is(err, fs.ErrNotExist) {
 			// Not enrolled for NetBird. Caller treats nil as
 			// "no MDM source present".
-			//nolint:nilnil // (nil, nil) is the documented platform-absent sentinel; see LoadPolicy.
+			//nolint:nilnil // (nil, nil) is the documented platform-absent sentinel; see Loader.Load.
 			return nil, nil
 		}
 		return nil, fmt.Errorf("open %s: %w", policyPlistPath, err)
diff --git a/client/mdm/policy_mobile.go b/client/mdm/policy_mobile.go
index ec25d4bb1..2e25a2bb5 100644
--- a/client/mdm/policy_mobile.go
+++ b/client/mdm/policy_mobile.go
@@ -2,13 +2,14 @@
 
 package mdm
 
-// loadPlatformPolicy is unused on mobile: the native layer (Swift on iOS,
-// Kotlin/Java on Android) reads the OS managed-config store and pushes the
-// resulting dictionary in-process via a gomobile entry point that lands in
-// Phase 5 / Phase 6. The stub keeps the package compilable for mobile
-// builds and returns (nil, nil) — the platform-absent sentinel that
-// LoadPolicy in policy.go treats as "no MDM source present".
-func loadPlatformPolicy() (map[string]any, error) {
-	//nolint:nilnil // (nil, nil) is the documented platform-absent sentinel; see LoadPolicy.
-	return nil, nil
+// loadPlatform reads the OS-managed configuration via the native
+// PolicyFetcher injected at Loader construction. Returns
+// (nil, nil) — the platform-absent sentinel that Loader.Load treats as
+// "no MDM source present" — when no fetcher was provided.
+func (l *Loader) loadPlatform() (map[string]any, error) {
+	if l == nil || l.fetcher == nil {
+		//nolint:nilnil // (nil, nil) is the documented platform-absent sentinel; see Loader.Load.
+		return nil, nil
+	}
+	return l.fetcher.Fetch(), nil
 }
diff --git a/client/mdm/policy_other.go b/client/mdm/policy_other.go
index f4263afa2..5d0b17cfd 100644
--- a/client/mdm/policy_other.go
+++ b/client/mdm/policy_other.go
@@ -2,13 +2,17 @@
 
 package mdm
 
-// loadPlatformPolicy returns no policy on platforms without an MDM channel
-// (Linux, FreeBSD). MDM enforcement is off and the client behaves as if
-// the feature did not exist. Returns (nil, nil) — the platform-absent
-// sentinel the caller (LoadPolicy in policy.go) treats as "no MDM
-// source present"; an error here would just translate to the same
-// outcome with an extra log line.
-func loadPlatformPolicy() (map[string]any, error) {
-	//nolint:nilnil // (nil, nil) is the documented platform-absent sentinel; see LoadPolicy.
+// loadPlatform reads the MDM policy on platforms without a native MDM
+// channel (Linux, FreeBSD). When no fetcher was injected the policy is
+// (nil, nil) — the platform-absent sentinel that Loader.Load treats as
+// "MDM enforcement disabled". A non-nil fetcher takes precedence: it
+// is the test-seam used by unit tests to inject a scripted policy
+// without touching the OS, and the same hook supports any future
+// non-mobile OS that grows an out-of-band MDM channel.
+func (l *Loader) loadPlatform() (map[string]any, error) {
+	if l != nil && l.fetcher != nil {
+		return l.fetcher.Fetch(), nil
+	}
+	//nolint:nilnil // (nil, nil) is the documented platform-absent sentinel; see Loader.Load.
 	return nil, nil
 }
diff --git a/client/mdm/policy_test.go b/client/mdm/policy_test.go
index 6cbe69776..ea467f861 100644
--- a/client/mdm/policy_test.go
+++ b/client/mdm/policy_test.go
@@ -1,6 +1,7 @@
 package mdm
 
 import (
+	"runtime"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -95,7 +96,8 @@ func TestPolicy_GetBool(t *testing.T) {
 		{"int64 nonzero", int64(2), true, true},
 		{"int64 zero", int64(0), false, true},
 		{"string garbage", "maybe", false, false},
-		{"float unsupported", 1.0, false, false},
+		{"float nonzero", 1.0, true, true},
+		{"float zero", 0.0, false, true},
 	}
 	for _, c := range cases {
 		t.Run(c.name, func(t *testing.T) {
@@ -155,10 +157,29 @@ func TestPolicy_GetStringSlice(t *testing.T) {
 	})
 }
 
-func TestLoadPolicy_PlatformStubReturnsEmpty(t *testing.T) {
-	// loadPlatformPolicy is a stub on every OS for Phase 1. LoadPolicy must
-	// degrade gracefully and never return nil.
-	p := LoadPolicy()
+// encoding/json decodes every JSON number into float64, so the mobile
+// loaders never see int.
+func TestJSONLoader_BoolFromNumber(t *testing.T) {
+	p := NewJSONLoader(func() string { return `{"blockInbound":1,"disableProfiles":0}` }).Load()
+
+	got, ok := p.GetBool(KeyBlockInbound)
+	assert.True(t, ok)
+	assert.True(t, got)
+
+	got, ok = p.GetBool(KeyDisableProfiles)
+	assert.True(t, ok)
+	assert.False(t, got)
+}
+
+func TestLoader_NilFetcherReturnsEmpty(t *testing.T) {
+	// Loader.Load with no fetcher (desktop construction) must degrade
+	// gracefully and never return nil; on linux loadPlatform is a stub
+	// returning (nil, nil), and Load is expected to translate that
+	// into a non-nil empty Policy.
+	if runtime.GOOS == "windows" || runtime.GOOS == "darwin" {
+		t.Skip("a nil fetcher reads the OS-managed policy on this platform")
+	}
+	p := NewLoader(nil).Load()
 	require.NotNil(t, p)
 	assert.True(t, p.IsEmpty())
 	assert.Empty(t, p.ManagedKeys())
diff --git a/client/mdm/policy_windows.go b/client/mdm/policy_windows.go
index 0c2629f98..9363db436 100644
--- a/client/mdm/policy_windows.go
+++ b/client/mdm/policy_windows.go
@@ -61,8 +61,9 @@ func readRegistryValue(k registry.Key, name, canonical string, out map[string]an
 	}
 }
 
-// loadPlatformPolicy reads the MDM-managed configuration from the
-// Windows registry under HKLM\Software\Policies\NetBird. Returns:
+// loadPlatform reads the MDM-managed configuration from the Windows
+// registry under HKLM\Software\Policies\NetBird, unless a fetcher was
+// injected, in which case its values are returned instead. Returns:
 //   - (nil, nil)  when the key is absent (device not MDM-enrolled for NetBird)
 //   - (map, nil)  with N entries when N managed values are set (N may be 0)
 //   - (nil, err)  on open / enumerate registry errors
@@ -70,12 +71,18 @@ func readRegistryValue(k registry.Key, name, canonical string, out map[string]an
 // Per-value type coercion + skip-on-error is delegated to
 // readRegistryValue. Unknown value names are logged and skipped so a
 // malformed deployment does not block startup.
-func loadPlatformPolicy() (map[string]any, error) {
+func (l *Loader) loadPlatform() (map[string]any, error) {
+	// Honour the injected fetcher when present so tests (and any
+	// future non-Windows MDM channel) can short-circuit the registry
+	// read with a scripted policy.
+	if l != nil && l.fetcher != nil {
+		return l.fetcher.Fetch(), nil
+	}
 	k, err := registry.OpenKey(registry.LOCAL_MACHINE, policyRegistryPath, registry.QUERY_VALUE)
 	if err != nil {
 		if errors.Is(err, registry.ErrNotExist) {
 			// Not enrolled. Caller treats nil as "no MDM source present".
-			//nolint:nilnil // (nil, nil) is the documented platform-absent sentinel; see LoadPolicy.
+			//nolint:nilnil // (nil, nil) is the documented platform-absent sentinel; see Loader.Load.
 			return nil, nil
 		}
 		return nil, fmt.Errorf("open %s: %w", policyRegistryPath, err)
diff --git a/client/mdm/restrictions.go b/client/mdm/restrictions.go
new file mode 100644
index 000000000..200756b78
--- /dev/null
+++ b/client/mdm/restrictions.go
@@ -0,0 +1,91 @@
+package mdm
+
+import "encoding/json"
+
+// Fields carries the per-key MDM enforcement state for a UI: value-typed
+// fields hold the enforced value (nil pointer = not managed), boolean
+// fields report that the key is managed.
+type Fields struct {
+	ManagementURL            string `json:"managementURL"`
+	PreSharedKey             bool   `json:"preSharedKey"`
+	WireguardPort            bool   `json:"wireguardPort"`
+	RosenpassEnabled         bool   `json:"rosenpassEnabled"`
+	RosenpassPermissive      bool   `json:"rosenpassPermissive"`
+	DisableClientRoutes      bool   `json:"disableClientRoutes"`
+	DisableServerRoutes      bool   `json:"disableServerRoutes"`
+	AllowServerSSH           *bool  `json:"allowServerSSH"`
+	DisableAutoConnect       bool   `json:"disableAutoConnect"`
+	DisableAutostart         bool   `json:"disableAutostart"`
+	BlockInbound             bool   `json:"blockInbound"`
+	DisableMetricsCollection bool   `json:"disableMetricsCollection"`
+	SplitTunnelMode          bool   `json:"splitTunnelMode"`
+	SplitTunnelApps          bool   `json:"splitTunnelApps"`
+	RemoteJobsAllowed        bool   `json:"allowRemoteJobs"`
+	DisableAdvancedView      *bool  `json:"disableAdvancedView"`
+}
+
+// Features carries the feature gates a UI must honor.
+type Features struct {
+	DisableProfiles       bool `json:"disableProfiles"`
+	DisableNetworks       bool `json:"disableNetworks"`
+	DisableUpdateSettings bool `json:"disableUpdateSettings"`
+}
+
+// Restrictions is the UI-facing enforcement snapshot; the JSON shape is
+// shared by the desktop frontend and the mobile bridges.
+type Restrictions struct {
+	MDM      Fields   `json:"mdm"`
+	Features Features `json:"features"`
+}
+
+// BuildRestrictions derives the UI enforcement snapshot from the active
+// policy.
+func BuildRestrictions(policy *Policy) Restrictions {
+	var r Restrictions
+	if policy.IsEmpty() {
+		return r
+	}
+
+	if v, ok := policy.GetString(KeyManagementURL); ok {
+		r.MDM.ManagementURL = CanonicalURL(v)
+	}
+	r.MDM.PreSharedKey = policy.HasKey(KeyPreSharedKey)
+	r.MDM.WireguardPort = policy.HasKey(KeyWireguardPort)
+	r.MDM.RosenpassEnabled = policy.HasKey(KeyRosenpassEnabled)
+	r.MDM.RosenpassPermissive = policy.HasKey(KeyRosenpassPermissive)
+	r.MDM.DisableClientRoutes = policy.HasKey(KeyDisableClientRoutes)
+	r.MDM.DisableServerRoutes = policy.HasKey(KeyDisableServerRoutes)
+	r.MDM.DisableAutoConnect = policy.HasKey(KeyDisableAutoConnect)
+	r.MDM.DisableAutostart = policy.HasKey(KeyDisableAutostart)
+	r.MDM.BlockInbound = policy.HasKey(KeyBlockInbound)
+	r.MDM.DisableMetricsCollection = policy.HasKey(KeyDisableMetricsCollection)
+	r.MDM.SplitTunnelMode = policy.HasKey(KeySplitTunnelMode)
+	r.MDM.SplitTunnelApps = policy.HasKey(KeySplitTunnelApps)
+	r.MDM.RemoteJobsAllowed = policy.HasKey(KeyRemoteJobsAllowed)
+	if v, ok := policy.GetBool(KeyAllowServerSSH); ok {
+		r.MDM.AllowServerSSH = &v
+	}
+	if v, ok := policy.GetBool(KeyDisableAdvancedView); ok {
+		r.MDM.DisableAdvancedView = &v
+	}
+
+	if v, ok := policy.GetBool(KeyDisableProfiles); ok {
+		r.Features.DisableProfiles = v
+	}
+	if v, ok := policy.GetBool(KeyDisableNetworks); ok {
+		r.Features.DisableNetworks = v
+	}
+	if v, ok := policy.GetBool(KeyDisableUpdateSettings); ok {
+		r.Features.DisableUpdateSettings = v
+	}
+	return r
+}
+
+// JSON renders the snapshot in the shared UI JSON shape.
+func (r Restrictions) JSON() (string, error) {
+	b, err := json.Marshal(r)
+	if err != nil {
+		return "", err
+	}
+	return string(b), nil
+}
diff --git a/client/mdm/ticker.go b/client/mdm/ticker.go
index abd6ae233..be8fdcce7 100644
--- a/client/mdm/ticker.go
+++ b/client/mdm/ticker.go
@@ -15,33 +15,33 @@ import (
 // instead, hence anticipating the ticker mechanism entirely.
 const DefaultReloadInterval = 1 * time.Minute
 
-// policyLoader is the indirection through which the ticker reads the
-// OS-native policy, both for the initial observation and on every tick.
-// Production points it at LoadPolicy; tests in this package override it to
-// feed a scripted sequence of policies without touching the real OS store.
-var policyLoader = LoadPolicy
-
-// Ticker periodically re-reads the OS-native MDM policy via LoadPolicy and
-// invokes the onChange callback (supplied to Run) whenever the observed
-// Policy diverges from the last observation (added / removed / changed
-// keys). Launch with Run from a goroutine; cancel the supplied context
-// to stop.
+// Ticker periodically re-reads the OS-native MDM policy via the
+// injected Loader and invokes the onChange callback (supplied to Run)
+// whenever the observed Policy diverges from the last observation
+// (added / removed / changed keys). Launch with Run from a goroutine;
+// cancel the supplied context to stop.
 type Ticker struct {
 	interval time.Duration
+	loader   *Loader
 	prev     *Policy
 }
 
 // NewTicker constructs a Ticker that will re-read the OS-native policy
-// every reloadInterval once Run is called.
-// The initial snapshot is populated by calling policyLoader at
+// every reloadInterval once Run is called. The Loader is injected so
+// the ticker doesn't depend on any package-level state — production
+// passes the daemon-owned Loader, tests pass a fake Loader (built with
+// a fake PolicyFetcher).
+//
+// The initial snapshot is populated by calling loader.Load() at
 // construction time so the first tick only fires
 // onChange when the policy actually changed since boot — without
 // this baseline the first tick would report every currently-managed
 // key as "added" and trigger a spurious engine restart.
-func NewTicker(reloadInterval time.Duration) *Ticker {
+func NewTicker(reloadInterval time.Duration, loader *Loader) *Ticker {
 	return &Ticker{
 		interval: reloadInterval,
-		prev:     policyLoader(),
+		loader:   loader,
+		prev:     loader.Load(),
 	}
 }
 
@@ -58,13 +58,10 @@ func (t *Ticker) Run(ctx context.Context, onChange func(prev, curr *Policy) erro
 			log.Info("MDM policy reload ticker stopped")
 			return
 		case <-tk.C:
-			curr := policyLoader()
-			if policiesEqual(t.prev, curr) {
+			curr := t.loader.Load()
+			if !policyChanged(t.prev, curr) {
 				continue
 			}
-			added, removed, changed := diffPolicies(t.prev, curr)
-			log.Infof("MDM policy changed: added=%v removed=%v changed=%v",
-				added, removed, changed)
 			prev := t.prev
 			if err := onChange(prev, curr); err != nil {
 				log.Errorf("MDM policy change handler failed (retrying in 1 minute): %v", err)
@@ -127,3 +124,12 @@ func mapOf(p *Policy) map[string]any {
 	}
 	return out
 }
+
+func policyChanged(prev, curr *Policy) bool {
+	if policiesEqual(prev, curr) {
+		return false
+	}
+	added, removed, changed := diffPolicies(prev, curr)
+	log.Infof("MDM policy changed: added=%v removed=%v changed=%v", added, removed, changed)
+	return true
+}
diff --git a/client/mdm/ticker_test.go b/client/mdm/ticker_test.go
index 17f3cfc2f..29e48e728 100644
--- a/client/mdm/ticker_test.go
+++ b/client/mdm/ticker_test.go
@@ -13,28 +13,40 @@ import (
 // testReloadInterval for speeding up the ticker cadence under `go test`
 const testReloadInterval = 1 * time.Second
 
-// withPolicyLoader overrides the package-level policyLoader for the duration
-// of the test so the ticker observes a scripted policy instead of the real
-// OS-native store. The original loader is restored on cleanup.
-func withPolicyLoader(t *testing.T, fn func() *Policy) {
-	t.Helper()
-	prev := policyLoader
-	policyLoader = fn
-	t.Cleanup(func() { policyLoader = prev })
+// fakePolicyFetcher implements PolicyFetcher returning a scripted
+// policy map. Goroutine-safe so the test can mutate the script while
+// the ticker is observing it.
+type fakePolicyFetcher struct {
+	mu     sync.Mutex
+	values map[string]any
+}
+
+func (f *fakePolicyFetcher) Fetch() map[string]any {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	if f.values == nil {
+		return nil
+	}
+	out := make(map[string]any, len(f.values))
+	for k, v := range f.values {
+		out[k] = v
+	}
+	return out
+}
+
+func (f *fakePolicyFetcher) set(values map[string]any) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.values = values
 }
 
 func TestTicker_FiresOnChangeWithDelta(t *testing.T) {
-	var mu sync.Mutex
-	current := NewPolicy(nil) // initial observation: empty (no enforcement)
-	withPolicyLoader(t, func() *Policy {
-		mu.Lock()
-		defer mu.Unlock()
-		return current
-	})
+	fetcher := &fakePolicyFetcher{} // initial observation: empty (no enforcement)
+	loader := NewLoader(fetcher)
 
 	type change struct{ prev, curr *Policy }
 	changes := make(chan change, 1)
-	tk := NewTicker(testReloadInterval)
+	tk := NewTicker(testReloadInterval, loader)
 	require.Equal(t, testReloadInterval, tk.interval)
 
 	ctx, cancel := context.WithCancel(context.Background())
@@ -49,15 +61,13 @@ func TestTicker_FiresOnChangeWithDelta(t *testing.T) {
 		})
 		close(done)
 	}()
-	// Stop Run and wait for it to exit before returning, so the policyLoader
-	// restore in t.Cleanup can't race the ticker goroutine still reading it.
+	// Stop Run and wait for it to exit before returning, so the test
+	// goroutine doesn't race the still-running ticker.
 	defer func() { cancel(); <-done }()
 
-	// Flip the OS-observed policy from empty to one managed key. The next
-	// tick must detect the diff and invoke onChange.
-	mu.Lock()
-	current = NewPolicy(map[string]any{KeyManagementURL: "https://mdm.example.com:443"})
-	mu.Unlock()
+	// Flip the OS-observed policy from empty to one managed key. The
+	// next tick must detect the diff and invoke onChange.
+	fetcher.set(map[string]any{KeyManagementURL: "https://mdm.example.com:443"})
 
 	select {
 	case c := <-changes:
@@ -69,12 +79,11 @@ func TestTicker_FiresOnChangeWithDelta(t *testing.T) {
 }
 
 func TestTicker_NoCallbackWhenPolicyUnchanged(t *testing.T) {
-	withPolicyLoader(t, func() *Policy {
-		return NewPolicy(map[string]any{KeyBlockInbound: true})
-	})
+	fetcher := &fakePolicyFetcher{values: map[string]any{KeyBlockInbound: true}}
+	loader := NewLoader(fetcher)
 
 	fired := make(chan struct{}, 1)
-	tk := NewTicker(testReloadInterval)
+	tk := NewTicker(testReloadInterval, loader)
 
 	ctx, cancel := context.WithCancel(context.Background())
 	done := make(chan struct{})
@@ -90,8 +99,8 @@ func TestTicker_NoCallbackWhenPolicyUnchanged(t *testing.T) {
 	}()
 	defer func() { cancel(); <-done }()
 
-	// Over ~2 ticks at the 1s test cadence the policy never changes, so the
-	// diff guard must suppress the callback entirely.
+	// Over ~2 ticks at the 1s test cadence the policy never changes,
+	// so the diff guard must suppress the callback entirely.
 	select {
 	case <-fired:
 		t.Fatal("onChange fired despite an unchanged policy")
diff --git a/client/mobile/profile_manager.go b/client/mobile/profile_manager.go
index 1ddabf0a9..348b7253b 100644
--- a/client/mobile/profile_manager.go
+++ b/client/mobile/profile_manager.go
@@ -4,6 +4,7 @@
 package mobile
 
 import (
+	"errors"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -11,6 +12,7 @@ import (
 	log "github.com/sirupsen/logrus"
 
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
+	"github.com/netbirdio/netbird/client/mdm"
 )
 
 const (
@@ -22,6 +24,9 @@ const (
 	profilesSubdir = "profiles"
 )
 
+// ErrProfilesDisabled marks a profile mutation rejected by MDM policy.
+var ErrProfilesDisabled = errors.New("profile management is disabled by MDM policy")
+
 /*
 
 <configDir>/                                    ← app-writable config root
@@ -55,6 +60,7 @@ type ProfileManager struct {
 	configDir  string
 	username   string
 	serviceMgr *profilemanager.ServiceManager
+	mdmLoader  *mdm.Loader
 }
 
 // NewProfileManager creates a profile manager rooted at configDir, the
@@ -127,6 +133,9 @@ func (pm *ProfileManager) GetActiveProfile() (*Profile, error) {
 // SwitchProfile records the given profile ID as the active profile. The caller
 // must stop the VPN tunnel before switching.
 func (pm *ProfileManager) SwitchProfile(id string) error {
+	if err := pm.checkProfilesAllowed(); err != nil {
+		return err
+	}
 	if err := pm.serviceMgr.SetActiveProfileState(&profilemanager.ActiveProfileState{
 		ID:       profilemanager.ID(id),
 		Username: pm.username,
@@ -141,6 +150,9 @@ func (pm *ProfileManager) SwitchProfile(id string) error {
 // AddProfile creates a new profile with the given display name and a
 // generated ID. It returns the created profile so the caller learns the ID.
 func (pm *ProfileManager) AddProfile(displayName string) (*Profile, error) {
+	if err := pm.checkProfilesAllowed(); err != nil {
+		return nil, err
+	}
 	profile, err := pm.serviceMgr.AddProfile(displayName, pm.username)
 	if err != nil {
 		return nil, fmt.Errorf("add profile: %w", err)
@@ -153,6 +165,9 @@ func (pm *ProfileManager) AddProfile(displayName string) (*Profile, error) {
 // RenameProfile changes the display name of the profile identified by id. The
 // on-disk filename (the ID) is left unchanged.
 func (pm *ProfileManager) RenameProfile(id string, newName string) error {
+	if err := pm.checkProfilesAllowed(); err != nil {
+		return err
+	}
 	if err := pm.serviceMgr.RenameProfile(profilemanager.ID(id), pm.username, newName); err != nil {
 		return fmt.Errorf("rename profile: %w", err)
 	}
@@ -165,6 +180,9 @@ func (pm *ProfileManager) RenameProfile(id string, newName string) error {
 // private key and SSH key from the config, forcing a re-login. The management
 // URL and other settings are preserved.
 func (pm *ProfileManager) LogoutProfile(id string) error {
+	if err := pm.checkProfileLogoutAllowed(id); err != nil {
+		return err
+	}
 	configPath, err := pm.getProfileConfigPath(id)
 	if err != nil {
 		return err
@@ -196,6 +214,9 @@ func (pm *ProfileManager) LogoutProfile(id string) error {
 // RemoveProfile deletes a profile. The default profile and the active profile
 // cannot be removed.
 func (pm *ProfileManager) RemoveProfile(id string) error {
+	if err := pm.checkProfilesAllowed(); err != nil {
+		return err
+	}
 	configPath, err := pm.getProfileConfigPath(id)
 	if err != nil {
 		return err
@@ -267,6 +288,27 @@ func (pm *ProfileManager) GetActiveStateFilePath() (string, error) {
 	return pm.GetStateFilePath(activeProfile.ID)
 }
 
+// SetMDMLoader registers the MDM policy source consulted before profile
+// mutations; a nil loader disables enforcement.
+func (pm *ProfileManager) SetMDMLoader(loader *mdm.Loader) {
+	pm.mdmLoader = loader
+}
+
+func (pm *ProfileManager) checkProfilesAllowed() error {
+	if v, ok := pm.mdmLoader.Load().GetBool(mdm.KeyDisableProfiles); ok && v {
+		return ErrProfilesDisabled
+	}
+	return nil
+}
+
+func (pm *ProfileManager) checkProfileLogoutAllowed(id string) error {
+	active, err := pm.serviceMgr.GetActiveProfileState()
+	if err == nil && active.ID.String() == id {
+		return nil
+	}
+	return pm.checkProfilesAllowed()
+}
+
 // profileEmail returns the account email recorded for a profile. Display-only,
 // so an unresolvable path degrades to "" rather than an error.
 func (pm *ProfileManager) profileEmail(id string) string {
diff --git a/client/mobile/profile_manager_mdm_test.go b/client/mobile/profile_manager_mdm_test.go
new file mode 100644
index 000000000..305becac3
--- /dev/null
+++ b/client/mobile/profile_manager_mdm_test.go
@@ -0,0 +1,83 @@
+package mobile
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/client/internal/profilemanager"
+	"github.com/netbirdio/netbird/client/mdm"
+)
+
+type fakeFetcher struct{ values map[string]any }
+
+func (f *fakeFetcher) Fetch() map[string]any { return f.values }
+
+func newTestProfileManager(t *testing.T) *ProfileManager {
+	t.Helper()
+	origDir := profilemanager.DefaultConfigPathDir
+	origPath := profilemanager.DefaultConfigPath
+	origActive := profilemanager.ActiveProfileStatePath
+	t.Cleanup(func() {
+		profilemanager.DefaultConfigPathDir = origDir
+		profilemanager.DefaultConfigPath = origPath
+		profilemanager.ActiveProfileStatePath = origActive
+	})
+
+	configDir := t.TempDir()
+	pm := NewProfileManager(configDir, "mobile")
+	_, err := profilemanager.UpdateOrCreateConfig(profilemanager.ConfigInput{
+		ConfigPath: filepath.Join(configDir, defaultConfigFilename),
+	})
+	require.NoError(t, err)
+	return pm
+}
+
+func privateKeyOf(t *testing.T, pm *ProfileManager, id string) string {
+	t.Helper()
+	path, err := pm.getProfileConfigPath(id)
+	require.NoError(t, err)
+	raw, err := os.ReadFile(path)
+	require.NoError(t, err)
+	var cfg struct{ PrivateKey string }
+	require.NoError(t, json.Unmarshal(raw, &cfg))
+	return cfg.PrivateKey
+}
+
+func TestLogoutProfile_DisableProfiles(t *testing.T) {
+	pm := newTestProfileManager(t)
+	other, err := pm.AddProfile("work")
+	require.NoError(t, err)
+	require.NoError(t, pm.SwitchProfile(profilemanager.DefaultProfileName))
+	require.NotEmpty(t, privateKeyOf(t, pm, profilemanager.DefaultProfileName))
+	require.NotEmpty(t, privateKeyOf(t, pm, other.ID))
+
+	pm.SetMDMLoader(mdm.NewLoader(&fakeFetcher{values: map[string]any{
+		mdm.KeyDisableProfiles: true,
+	}}))
+
+	err = pm.LogoutProfile(other.ID)
+	assert.ErrorIs(t, err, ErrProfilesDisabled)
+	assert.NotEmpty(t, privateKeyOf(t, pm, other.ID))
+
+	require.NoError(t, pm.LogoutProfile(profilemanager.DefaultProfileName))
+	assert.Empty(t, privateKeyOf(t, pm, profilemanager.DefaultProfileName))
+}
+
+func TestLogoutProfile_ProfilesAllowed(t *testing.T) {
+	pm := newTestProfileManager(t)
+	other, err := pm.AddProfile("work")
+	require.NoError(t, err)
+	require.NoError(t, pm.SwitchProfile(profilemanager.DefaultProfileName))
+
+	pm.SetMDMLoader(mdm.NewLoader(&fakeFetcher{values: map[string]any{
+		mdm.KeyDisableProfiles: false,
+	}}))
+
+	require.NoError(t, pm.LogoutProfile(other.ID))
+	assert.Empty(t, privateKeyOf(t, pm, other.ID))
+}
diff --git a/client/server/mdm.go b/client/server/mdm.go
index b41e2b590..7a47b2a57 100644
--- a/client/server/mdm.go
+++ b/client/server/mdm.go
@@ -3,7 +3,6 @@ package server
 import (
 	"context"
 	"fmt"
-	"net/url"
 	"time"
 
 	log "github.com/sirupsen/logrus"
@@ -14,28 +13,6 @@ import (
 	"github.com/netbirdio/netbird/client/proto"
 )
 
-// preSharedKeyRedactedSentinel is the value GetConfig returns in place
-// of an actual PSK, so a UI that round-trips the field back to the
-// daemon (via SetConfig / Login) can be distinguished from a deliberate
-// override. Any incoming PSK that equals this sentinel is treated as
-// a no-op echo, never as a conflict with the policy.
-const preSharedKeyRedactedSentinel = "**********"
-
-// loadMDMPolicy is the indirection used by server handlers to read the
-// active MDM policy. Tests override this to inject a fake policy.
-var loadMDMPolicy = mdm.LoadPolicy
-
-// conflictCheck is a value-aware comparison between a single field in
-// the incoming request and the corresponding MDM-enforced value. It
-// runs only when the field was actually set in the request (presence
-// already filtered upstream); ok=true reports the policy value, ok=false
-// means the policy is silent on the key — both are treated as conflicts
-// to be safe (an MDM key declared as managed must hold a value).
-type conflictCheck struct {
-	key   string
-	check func(*mdm.Policy) (match bool)
-}
-
 // onMDMPolicyChange is invoked by the MDM reload ticker every time the
 // OS-native managed-config store reports a diff vs the last observation.
 //
@@ -168,126 +145,6 @@ func (s *Server) restartEngineForMDMLocked() error {
 	return nil
 }
 
-// conflictBool builds a conflictCheck for a boolean MDM key. If p is nil
-// the field is treated as matching (no override requested); otherwise the
-// check returns true only when the policy contains the key and its
-// boolean value equals *p.
-func conflictBool(key string, p *bool) conflictCheck {
-	return conflictCheck{
-		key: key,
-		check: func(pol *mdm.Policy) bool {
-			if p == nil {
-				return true // absent → match by definition
-			}
-			want, ok := pol.GetBool(key)
-			return ok && want == *p
-		},
-	}
-}
-
-func canonicalURL(s string) string {
-	u, err := url.ParseRequestURI(s)
-	if err != nil {
-		return s
-	}
-	if u.Port() == "" {
-		switch u.Scheme {
-		case "https":
-			u.Host += ":443"
-		case "http":
-			u.Host += ":80"
-		}
-	}
-	return u.String()
-}
-
-// conflictURL is conflictString for URL-typed keys: both sides are
-// normalized via canonicalURL before comparison.
-func conflictURL(key, got string) conflictCheck {
-	return conflictCheck{
-		key: key,
-		check: func(pol *mdm.Policy) bool {
-			if got == "" {
-				return true
-			}
-			want, ok := pol.GetString(key)
-			return ok && canonicalURL(want) == canonicalURL(got)
-		},
-	}
-}
-
-// conflictString builds a conflictCheck for a string MDM key. An empty
-// `got` is treated as "field not set" (no override requested); otherwise
-// the check returns true only when the policy contains the key and its
-// value equals got.
-func conflictString(key, got string) conflictCheck {
-	return conflictCheck{
-		key: key,
-		check: func(pol *mdm.Policy) bool {
-			if got == "" {
-				return true
-			}
-			want, ok := pol.GetString(key)
-			return ok && want == got
-		},
-	}
-}
-
-// conflictStringPtr is conflictString for optional proto fields, where an
-// explicit empty value is still a request to change the setting. If p is
-// nil the field is treated as matching (no override requested); otherwise
-// the check returns true only when the policy contains the key and its
-// value equals *p.
-func conflictStringPtr(key string, p *string) conflictCheck {
-	return conflictCheck{
-		key: key,
-		check: func(pol *mdm.Policy) bool {
-			if p == nil {
-				return true
-			}
-			want, ok := pol.GetString(key)
-			return ok && want == *p
-		},
-	}
-}
-
-// conflictInt64 builds a conflictCheck for an integer MDM key. If p is
-// nil the field is treated as matching; otherwise the check returns
-// true only when the policy contains the key and its int value equals *p.
-func conflictInt64(key string, p *int64) conflictCheck {
-	return conflictCheck{
-		key: key,
-		check: func(pol *mdm.Policy) bool {
-			if p == nil {
-				return true
-			}
-			want, ok := pol.GetInt(key)
-			return ok && want == *p
-		},
-	}
-}
-
-// resolveConflicts walks the per-field checks against the active MDM
-// policy and returns the names of keys whose requested value diverges
-// from the policy-enforced value. Keys not present in the policy are
-// skipped silently (the gate fires only for keys the admin has
-// actually pushed). Returns nil for an empty policy.
-func resolveConflicts(policy *mdm.Policy, checks []conflictCheck) []string {
-	if policy.IsEmpty() {
-		return nil
-	}
-	var conflicts []string
-	for _, c := range checks {
-		if !policy.HasKey(c.key) {
-			continue
-		}
-		if !c.check(policy) {
-			conflicts = append(conflicts, c.key)
-		}
-	}
-	return conflicts
-}
-
 // mdmManagedFieldConflicts returns the names of MDM-managed keys whose
 // requested value in the SetConfigRequest differs from the MDM-enforced
 // value. A field set to the same value the policy already enforces is
@@ -301,27 +158,25 @@ func mdmManagedFieldConflicts(msg *proto.SetConfigRequest, policy *mdm.Policy) [
 		return nil
 	}
 
-	// PSK round-trip echo: collapse the sentinel to empty so the
-	// shared check treats it as "field not set".
-	pskGot := ""
-	if msg.OptionalPreSharedKey != nil && *msg.OptionalPreSharedKey != preSharedKeyRedactedSentinel {
-		pskGot = *msg.OptionalPreSharedKey
+	pskGot := msg.OptionalPreSharedKey
+	if pskGot != nil && *pskGot == mdm.PreSharedKeyRedactedSentinel {
+		pskGot = nil
 	}
 
-	return resolveConflicts(policy, []conflictCheck{
-		conflictURL(mdm.KeyManagementURL, msg.ManagementUrl),
-		conflictString(mdm.KeyPreSharedKey, pskGot),
-		conflictBool(mdm.KeyRosenpassEnabled, msg.RosenpassEnabled),
-		conflictBool(mdm.KeyRosenpassPermissive, msg.RosenpassPermissive),
-		conflictBool(mdm.KeyDisableAutoConnect, msg.DisableAutoConnect),
-		conflictBool(mdm.KeyAllowServerSSH, msg.ServerSSHAllowed),
-		conflictBool(mdm.KeyRemoteJobsAllowed, msg.RemoteJobsAllowed),
-		conflictBool(mdm.KeyDisableClientRoutes, msg.DisableClientRoutes),
-		conflictBool(mdm.KeyDisableServerRoutes, msg.DisableServerRoutes),
-		conflictBool(mdm.KeyBlockInbound, msg.BlockInbound),
-		conflictInt64(mdm.KeyWireguardPort, msg.WireguardPort),
-		conflictBool(mdm.KeyEnableLocalMetrics, msg.EnableLocalMetrics),
-		conflictStringPtr(mdm.KeyLocalMetricsAddress, msg.LocalMetricsAddress),
+	return mdm.ResolveConflicts(policy, []mdm.ConflictCheck{
+		mdm.ConflictURL(mdm.KeyManagementURL, msg.ManagementUrl),
+		mdm.ConflictStringPtr(mdm.KeyPreSharedKey, pskGot),
+		mdm.ConflictBool(mdm.KeyRosenpassEnabled, msg.RosenpassEnabled),
+		mdm.ConflictBool(mdm.KeyRosenpassPermissive, msg.RosenpassPermissive),
+		mdm.ConflictBool(mdm.KeyDisableAutoConnect, msg.DisableAutoConnect),
+		mdm.ConflictBool(mdm.KeyAllowServerSSH, msg.ServerSSHAllowed),
+		mdm.ConflictBool(mdm.KeyRemoteJobsAllowed, msg.RemoteJobsAllowed),
+		mdm.ConflictBool(mdm.KeyDisableClientRoutes, msg.DisableClientRoutes),
+		mdm.ConflictBool(mdm.KeyDisableServerRoutes, msg.DisableServerRoutes),
+		mdm.ConflictBool(mdm.KeyBlockInbound, msg.BlockInbound),
+		mdm.ConflictInt64(mdm.KeyWireguardPort, msg.WireguardPort),
+		mdm.ConflictBool(mdm.KeyEnableLocalMetrics, msg.EnableLocalMetrics),
+		mdm.ConflictStringPtr(mdm.KeyLocalMetricsAddress, msg.LocalMetricsAddress),
 	})
 }
 
@@ -424,34 +279,28 @@ func loginRequestMDMConflicts(msg *proto.LoginRequest, policy *mdm.Policy) []str
 		return nil
 	}
 
-	// Collapse the two PSK fields + the redaction sentinel down to a
-	// single "got" string the shared check can compare against the
-	// policy: OptionalPreSharedKey wins if set; PreSharedKey (deprecated)
-	// is the fallback; sentinel echo is treated as "field not set".
-	pskGot := ""
-	if msg.OptionalPreSharedKey != nil {
-		pskGot = *msg.OptionalPreSharedKey
-	} else if msg.PreSharedKey != "" { //nolint:staticcheck // SA1019: legacy proto field still accepted by Login
-		pskGot = msg.PreSharedKey //nolint:staticcheck // SA1019
+	pskGot := msg.OptionalPreSharedKey
+	if pskGot == nil && msg.PreSharedKey != "" { //nolint:staticcheck // SA1019: legacy proto field still accepted by Login
+		pskGot = &msg.PreSharedKey //nolint:staticcheck // SA1019
 	}
-	if pskGot == preSharedKeyRedactedSentinel {
-		pskGot = ""
+	if pskGot != nil && *pskGot == mdm.PreSharedKeyRedactedSentinel {
+		pskGot = nil
 	}
 
-	return resolveConflicts(policy, []conflictCheck{
-		conflictURL(mdm.KeyManagementURL, msg.ManagementUrl),
-		conflictString(mdm.KeyPreSharedKey, pskGot),
-		conflictBool(mdm.KeyRosenpassEnabled, msg.RosenpassEnabled),
-		conflictBool(mdm.KeyRosenpassPermissive, msg.RosenpassPermissive),
-		conflictBool(mdm.KeyDisableAutoConnect, msg.DisableAutoConnect),
-		conflictBool(mdm.KeyAllowServerSSH, msg.ServerSSHAllowed),
-		conflictBool(mdm.KeyRemoteJobsAllowed, msg.RemoteJobsAllowed),
-		conflictBool(mdm.KeyDisableClientRoutes, msg.DisableClientRoutes),
-		conflictBool(mdm.KeyDisableServerRoutes, msg.DisableServerRoutes),
-		conflictBool(mdm.KeyBlockInbound, msg.BlockInbound),
-		conflictInt64(mdm.KeyWireguardPort, msg.WireguardPort),
-		conflictBool(mdm.KeyEnableLocalMetrics, msg.EnableLocalMetrics),
-		conflictStringPtr(mdm.KeyLocalMetricsAddress, msg.LocalMetricsAddress),
+	return mdm.ResolveConflicts(policy, []mdm.ConflictCheck{
+		mdm.ConflictURL(mdm.KeyManagementURL, msg.ManagementUrl),
+		mdm.ConflictStringPtr(mdm.KeyPreSharedKey, pskGot),
+		mdm.ConflictBool(mdm.KeyRosenpassEnabled, msg.RosenpassEnabled),
+		mdm.ConflictBool(mdm.KeyRosenpassPermissive, msg.RosenpassPermissive),
+		mdm.ConflictBool(mdm.KeyDisableAutoConnect, msg.DisableAutoConnect),
+		mdm.ConflictBool(mdm.KeyAllowServerSSH, msg.ServerSSHAllowed),
+		mdm.ConflictBool(mdm.KeyRemoteJobsAllowed, msg.RemoteJobsAllowed),
+		mdm.ConflictBool(mdm.KeyDisableClientRoutes, msg.DisableClientRoutes),
+		mdm.ConflictBool(mdm.KeyDisableServerRoutes, msg.DisableServerRoutes),
+		mdm.ConflictBool(mdm.KeyBlockInbound, msg.BlockInbound),
+		mdm.ConflictInt64(mdm.KeyWireguardPort, msg.WireguardPort),
+		mdm.ConflictBool(mdm.KeyEnableLocalMetrics, msg.EnableLocalMetrics),
+		mdm.ConflictStringPtr(mdm.KeyLocalMetricsAddress, msg.LocalMetricsAddress),
 	})
 }
 
diff --git a/client/server/server.go b/client/server/server.go
index 410a9d98f..108aa8a41 100644
--- a/client/server/server.go
+++ b/client/server/server.go
@@ -138,6 +138,15 @@ type Server struct {
 	// stopped by the rootCtx cancellation.
 	mdmTicker *mdm.Ticker
 
+	// mdmLoader is the daemon-owned source of the active MDM policy.
+	// Constructed once during Server.Start (with a nil PolicyFetcher on
+	// desktop — the build-tagged Loader.loadPlatform reads the OS
+	// registry / plist directly) and injected into every consumer:
+	// mdmTicker for its periodic reload, the SetConfig / Login MDM
+	// gates for conflict detection, and every Config produced via
+	// getConfig() so its apply() picks up the same overlay.
+	mdmLoader *mdm.Loader
+
 	updateManager *updater.Manager
 
 	jwtCache *jwtCache
@@ -246,8 +255,14 @@ func (s *Server) Start() error {
 	// Runs re-resolves Config (re-running profilemanager.Config.apply which
 	// applies the freshly-read MDM policy as the last layer) and brings
 	// the engine back with the new values.
+	if s.mdmLoader == nil {
+		// Desktop builds pass a nil PolicyFetcher: the Loader's
+		// build-tagged loadPlatform reads the OS source directly
+		// (registry on Windows, plist on macOS, no-op elsewhere).
+		s.mdmLoader = mdm.NewLoader(nil)
+	}
 	if s.mdmTicker == nil {
-		s.mdmTicker = mdm.NewTicker(mdm.DefaultReloadInterval)
+		s.mdmTicker = mdm.NewTicker(mdm.DefaultReloadInterval, s.mdmLoader)
 		go s.mdmTicker.Run(s.rootCtx, s.onMDMPolicyChange)
 	}
 
@@ -493,7 +508,7 @@ func (s *Server) SetConfig(callerCtx context.Context, msg *proto.SetConfigReques
 	// by the active MDM policy. The error carries an MDMManagedFields-
 	// Violation detail listing the offending key names. Non-conflicting
 	// fields in the same request are not applied either.
-	policy := loadMDMPolicy()
+	policy := s.mdmLoader.Load()
 	if err := rejectMDMManagedFieldConflicts(mdmManagedFieldConflicts(msg, policy)); err != nil {
 		return nil, err
 	}
@@ -636,7 +651,7 @@ func (s *Server) Login(callerCtx context.Context, msg *proto.LoginRequest) (*pro
 		if s.checkUpdateSettingsDisabled() {
 			return nil, gstatus.Errorf(codes.Unavailable, errUpdateSettingsDisabled)
 		}
-		policy := loadMDMPolicy()
+		policy := s.mdmLoader.Load()
 		if err := rejectMDMManagedFieldConflicts(loginRequestMDMConflicts(msg, policy)); err != nil {
 			return nil, err
 		}
@@ -1487,6 +1502,12 @@ func (s *Server) getConfig(activeProf *profilemanager.ActiveProfileState) (*prof
 		return nil, false, fmt.Errorf("failed to get config: %w", err)
 	}
 
+	// Apply the daemon-owned MDM policy on top of the just-resolved
+	// Config. profilemanager's apply() initialises the policy to
+	// empty — the Loader lives outside Config, so this overlay step
+	// is driven externally here.
+	config.ApplyMDMPolicy(s.mdmLoader.Load())
+
 	return config, configExisted, nil
 }
 
@@ -1543,6 +1564,9 @@ func (s *Server) logoutFromProfile(ctx context.Context, profile *profilemanager.
 	if err != nil {
 		return fmt.Errorf("profile '%s' not found", profile.ID)
 	}
+	// Honour any MDM-enforced ManagementURL when issuing the logout
+	// RPC: the user-stored value may have been overridden by policy.
+	config.ApplyMDMPolicy(s.mdmLoader.Load())
 
 	return s.sendLogoutRequestWithConfig(ctx, config)
 }
@@ -2177,6 +2201,11 @@ func (s *Server) GetConfig(ctx context.Context, req *proto.GetConfigRequest) (*p
 		log.Errorf("failed to get active profile config: %v", err)
 		return nil, fmt.Errorf("failed to get active profile config: %w", err)
 	}
+	// Overlay the active MDM policy so the response's MDMManagedFields
+	// list reflects what the GUI / CLI must render as read-only.
+	// profilemanager.GetConfig itself returns a Config without the
+	// overlay (Loader lives outside profilemanager).
+	cfg.ApplyMDMPolicy(s.mdmLoader.Load())
 	managementURL := cfg.ManagementURL
 	adminURL := cfg.AdminURL
 
diff --git a/client/server/setconfig_mdm_test.go b/client/server/setconfig_mdm_test.go
index ad3b7ade7..a392af6d3 100644
--- a/client/server/setconfig_mdm_test.go
+++ b/client/server/setconfig_mdm_test.go
@@ -16,14 +16,40 @@ import (
 	"github.com/netbirdio/netbird/client/proto"
 )
 
-// withMDMPolicy temporarily overrides the server-package loadMDMPolicy hook
-// so SetConfig observes the supplied Policy. Restores the original loader
-// at test cleanup.
-func withMDMPolicy(t *testing.T, policy *mdm.Policy) {
+// fakeMDMFetcher implements mdm.PolicyFetcher returning a pre-set
+// policy map. Tests build one per Server instance to inject a
+// scripted MDM overlay via a Loader rather than via package-level state.
+type fakeMDMFetcher struct{ values map[string]any }
+
+func (f *fakeMDMFetcher) Fetch() map[string]any { return f.values }
+
+// withMDMPolicy installs an mdm.Loader on the given Server whose
+// loadPlatform returns the supplied Policy's underlying values. Use
+// after setupServerWithProfile to inject the scripted policy the
+// SetConfig / Login MDM gates will observe.
+func withMDMPolicy(t *testing.T, s *Server, policy *mdm.Policy) {
 	t.Helper()
-	prev := loadMDMPolicy
-	loadMDMPolicy = func() *mdm.Policy { return policy }
-	t.Cleanup(func() { loadMDMPolicy = prev })
+	values := map[string]any{}
+	if policy != nil {
+		for _, k := range policy.ManagedKeys() {
+			if v, ok := policy.GetString(k); ok {
+				values[k] = v
+				continue
+			}
+			if v, ok := policy.GetInt(k); ok {
+				values[k] = v
+				continue
+			}
+			if v, ok := policy.GetBool(k); ok {
+				values[k] = v
+				continue
+			}
+			if v, ok := policy.GetStringSlice(k); ok {
+				values[k] = v
+			}
+		}
+	}
+	s.mdmLoader = mdm.NewLoader(&fakeMDMFetcher{values: values})
 }
 
 // setupServerWithProfile mirrors the boilerplate of TestSetConfig_AllFieldsSaved:
@@ -93,12 +119,11 @@ func extractViolation(t *testing.T, err error) *proto.MDMManagedFieldsViolation
 }
 
 func TestSetConfig_MDMReject_SingleField(t *testing.T) {
-	withMDMPolicy(t, mdm.NewPolicy(map[string]any{
+	s, ctx, profName, username, _ := setupServerWithProfile(t)
+	withMDMPolicy(t, s, mdm.NewPolicy(map[string]any{
 		mdm.KeyManagementURL: "https://mdm.example.com:443",
 	}))
 
-	s, ctx, profName, username, _ := setupServerWithProfile(t)
-
 	_, err := s.SetConfig(ctx, &proto.SetConfigRequest{
 		ProfileName:   profName,
 		Username:      username,
@@ -110,14 +135,13 @@ func TestSetConfig_MDMReject_SingleField(t *testing.T) {
 }
 
 func TestSetConfig_MDMReject_MultipleFields(t *testing.T) {
-	withMDMPolicy(t, mdm.NewPolicy(map[string]any{
+	s, ctx, profName, username, _ := setupServerWithProfile(t)
+	withMDMPolicy(t, s, mdm.NewPolicy(map[string]any{
 		mdm.KeyManagementURL:    "https://mdm.example.com:443",
 		mdm.KeyBlockInbound:     true,
 		mdm.KeyRosenpassEnabled: true,
 	}))
 
-	s, ctx, profName, username, _ := setupServerWithProfile(t)
-
 	blockInbound := false
 	rosenpassEnabled := false
 	_, err := s.SetConfig(ctx, &proto.SetConfigRequest{
@@ -137,13 +161,12 @@ func TestSetConfig_MDMReject_MultipleFields(t *testing.T) {
 }
 
 func TestSetConfig_MDMReject_LocalMetrics(t *testing.T) {
-	withMDMPolicy(t, mdm.NewPolicy(map[string]any{
+	s, ctx, profName, username, _ := setupServerWithProfile(t)
+	withMDMPolicy(t, s, mdm.NewPolicy(map[string]any{
 		mdm.KeyEnableLocalMetrics:  true,
 		mdm.KeyLocalMetricsAddress: "127.0.0.1:9191",
 	}))
 
-	s, ctx, profName, username, _ := setupServerWithProfile(t)
-
 	enabled := false
 	addr := "0.0.0.0:9999"
 	_, err := s.SetConfig(ctx, &proto.SetConfigRequest{
@@ -164,12 +187,11 @@ func TestSetConfig_MDMReject_LocalMetrics(t *testing.T) {
 // (the manager falls back to the default), so presence must be honored
 // rather than collapsed to "field not set".
 func TestSetConfig_MDMReject_LocalMetricsEmptyAddress(t *testing.T) {
-	withMDMPolicy(t, mdm.NewPolicy(map[string]any{
+	s, ctx, profName, username, _ := setupServerWithProfile(t)
+	withMDMPolicy(t, s, mdm.NewPolicy(map[string]any{
 		mdm.KeyLocalMetricsAddress: "127.0.0.1:9999",
 	}))
 
-	s, ctx, profName, username, _ := setupServerWithProfile(t)
-
 	addr := ""
 	_, err := s.SetConfig(ctx, &proto.SetConfigRequest{
 		ProfileName:         profName,
@@ -181,17 +203,80 @@ func TestSetConfig_MDMReject_LocalMetricsEmptyAddress(t *testing.T) {
 	assert.ElementsMatch(t, []string{mdm.KeyLocalMetricsAddress}, v.GetFields())
 }
 
+func TestSetConfig_MDMReject_EmptyPreSharedKey(t *testing.T) {
+	s, ctx, profName, username, _ := setupServerWithProfile(t)
+	withMDMPolicy(t, s, mdm.NewPolicy(map[string]any{
+		mdm.KeyPreSharedKey: "mdm-enforced-psk",
+	}))
+
+	psk := ""
+	_, err := s.SetConfig(ctx, &proto.SetConfigRequest{
+		ProfileName:          profName,
+		Username:             username,
+		OptionalPreSharedKey: &psk,
+	})
+
+	v := extractViolation(t, err)
+	assert.ElementsMatch(t, []string{mdm.KeyPreSharedKey}, v.GetFields())
+}
+
+func TestSetConfig_MDMAllow_PreSharedKeySentinelEcho(t *testing.T) {
+	s, ctx, profName, username, _ := setupServerWithProfile(t)
+	withMDMPolicy(t, s, mdm.NewPolicy(map[string]any{
+		mdm.KeyPreSharedKey: "mdm-enforced-psk",
+	}))
+
+	psk := mdm.PreSharedKeyRedactedSentinel
+	resp, err := s.SetConfig(ctx, &proto.SetConfigRequest{
+		ProfileName:          profName,
+		Username:             username,
+		OptionalPreSharedKey: &psk,
+	})
+
+	require.NoError(t, err)
+	require.NotNil(t, resp)
+}
+
+func TestLoginRequestMDMConflicts_PreSharedKey(t *testing.T) {
+	policy := mdm.NewPolicy(map[string]any{
+		mdm.KeyPreSharedKey: "mdm-enforced-psk",
+	})
+	empty := ""
+	sentinel := mdm.PreSharedKeyRedactedSentinel
+	same := "mdm-enforced-psk"
+	other := "user-psk"
+
+	tests := []struct {
+		name string
+		msg  *proto.LoginRequest
+		want []string
+	}{
+		{name: "unset", msg: &proto.LoginRequest{}, want: nil},
+		{name: "optional empty", msg: &proto.LoginRequest{OptionalPreSharedKey: &empty}, want: []string{mdm.KeyPreSharedKey}},
+		{name: "optional sentinel echo", msg: &proto.LoginRequest{OptionalPreSharedKey: &sentinel}, want: nil},
+		{name: "optional same value", msg: &proto.LoginRequest{OptionalPreSharedKey: &same}, want: nil},
+		{name: "optional divergent", msg: &proto.LoginRequest{OptionalPreSharedKey: &other}, want: []string{mdm.KeyPreSharedKey}},
+		{name: "legacy empty is unset", msg: &proto.LoginRequest{PreSharedKey: ""}, want: nil},                         //nolint:staticcheck // SA1019: legacy proto field still accepted by Login
+		{name: "legacy sentinel echo", msg: &proto.LoginRequest{PreSharedKey: sentinel}, want: nil},                    //nolint:staticcheck // SA1019: legacy proto field still accepted by Login
+		{name: "legacy divergent", msg: &proto.LoginRequest{PreSharedKey: other}, want: []string{mdm.KeyPreSharedKey}}, //nolint:staticcheck // SA1019: legacy proto field still accepted by Login
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			assert.Equal(t, tc.want, loginRequestMDMConflicts(tc.msg, policy))
+		})
+	}
+}
+
 func TestSetConfig_MDMReject_AllOrNothing(t *testing.T) {
 	// MDM enforces ManagementURL only; user request touches both the
 	// enforced field AND a non-enforced field (RosenpassEnabled).
 	// The whole request must be rejected — non-conflicting fields are not
 	// applied either.
-	withMDMPolicy(t, mdm.NewPolicy(map[string]any{
+	s, ctx, profName, username, cfgPath := setupServerWithProfile(t)
+	withMDMPolicy(t, s, mdm.NewPolicy(map[string]any{
 		mdm.KeyManagementURL: "https://mdm.example.com:443",
 	}))
 
-	s, ctx, profName, username, cfgPath := setupServerWithProfile(t)
-
 	rosenpassEnabled := true
 	_, err := s.SetConfig(ctx, &proto.SetConfigRequest{
 		ProfileName:      profName,
@@ -213,12 +298,11 @@ func TestSetConfig_MDMReject_AllOrNothing(t *testing.T) {
 func TestSetConfig_MDMAllow_NonManagedFields(t *testing.T) {
 	// MDM enforces ManagementURL but the user only writes RosenpassEnabled.
 	// Request must succeed.
-	withMDMPolicy(t, mdm.NewPolicy(map[string]any{
+	s, ctx, profName, username, _ := setupServerWithProfile(t)
+	withMDMPolicy(t, s, mdm.NewPolicy(map[string]any{
 		mdm.KeyManagementURL: "https://mdm.example.com:443",
 	}))
 
-	s, ctx, profName, username, _ := setupServerWithProfile(t)
-
 	rosenpassEnabled := true
 	resp, err := s.SetConfig(ctx, &proto.SetConfigRequest{
 		ProfileName:      profName,
@@ -247,12 +331,11 @@ func TestSetConfig_MDMAllow_ManagementURLPortNormalized(t *testing.T) {
 
 	for _, tc := range tests {
 		t.Run(tc.name, func(t *testing.T) {
-			withMDMPolicy(t, mdm.NewPolicy(map[string]any{
+			s, ctx, profName, username, _ := setupServerWithProfile(t)
+			withMDMPolicy(t, s, mdm.NewPolicy(map[string]any{
 				mdm.KeyManagementURL: tc.mdmURL,
 			}))
 
-			s, ctx, profName, username, _ := setupServerWithProfile(t)
-
 			rosenpassEnabled := true
 			resp, err := s.SetConfig(ctx, &proto.SetConfigRequest{
 				ProfileName:      profName,
@@ -269,9 +352,8 @@ func TestSetConfig_MDMAllow_ManagementURLPortNormalized(t *testing.T) {
 
 func TestSetConfig_MDMEmpty_NoEnforcement(t *testing.T) {
 	// No MDM policy active: any field can be written.
-	withMDMPolicy(t, mdm.NewPolicy(nil))
-
 	s, ctx, profName, username, _ := setupServerWithProfile(t)
+	withMDMPolicy(t, s, mdm.NewPolicy(nil))
 
 	resp, err := s.SetConfig(ctx, &proto.SetConfigRequest{
 		ProfileName:   profName,
diff --git a/client/ssh/handshake.go b/client/ssh/handshake.go
index e78a806be..a718748df 100644
--- a/client/ssh/handshake.go
+++ b/client/ssh/handshake.go
@@ -5,7 +5,6 @@ import (
 	"fmt"
 	"io"
 	"net"
-	"time"
 
 	log "github.com/sirupsen/logrus"
 	"golang.org/x/crypto/ssh"
@@ -13,26 +12,23 @@ import (
 
 // Handshake runs the SSH client handshake on an already dialed conn and
 // returns the resulting client. Dialing bounds only the TCP establishment;
-// without a deadline on the socket a peer that accepts and then goes silent
-// blocks the handshake forever, so the context deadline is applied to conn
-// for the duration of the handshake. conn is closed on any error.
+// a peer that accepts and then goes silent would block the handshake forever,
+// so conn is closed as soon as ctx is done, which unblocks the handshake and
+// surfaces the context error. conn is closed on any error.
 func Handshake(ctx context.Context, conn net.Conn, addr string, config *ssh.ClientConfig) (*ssh.Client, error) {
-	if deadline, ok := ctx.Deadline(); ok {
-		if err := conn.SetDeadline(deadline); err != nil {
-			closeHandshake(conn, "conn after deadline error")
-			return nil, fmt.Errorf("set handshake deadline: %w", err)
-		}
-	}
+	stop := context.AfterFunc(ctx, func() { closeHandshake(conn, "conn on context done") })
 
 	sshConn, chans, reqs, err := ssh.NewClientConn(conn, addr, config)
 	if err != nil {
-		closeHandshake(conn, "conn after handshake error")
-		return nil, fmt.Errorf("ssh handshake: %w", err)
+		if stop() {
+			closeHandshake(conn, "conn after handshake error")
+		}
+		return nil, handshakeError(ctx, err)
 	}
 
-	if err := conn.SetDeadline(time.Time{}); err != nil {
-		closeHandshake(sshConn, "ssh conn after deadline clear error")
-		return nil, fmt.Errorf("clear handshake deadline: %w", err)
+	if !stop() {
+		closeHandshake(sshConn, "ssh conn after context done")
+		return nil, fmt.Errorf("ssh handshake: %w", ctx.Err())
 	}
 
 	return ssh.NewClient(sshConn, chans, reqs), nil
@@ -43,3 +39,10 @@ func closeHandshake(c io.Closer, label string) {
 		log.Debugf("ssh: close %s: %v", label, err)
 	}
 }
+
+func handshakeError(ctx context.Context, err error) error {
+	if ctxErr := ctx.Err(); ctxErr != nil {
+		return fmt.Errorf("ssh handshake: %w: %w", ctxErr, err)
+	}
+	return fmt.Errorf("ssh handshake: %w", err)
+}
diff --git a/client/ssh/handshake_test.go b/client/ssh/handshake_test.go
new file mode 100644
index 000000000..77a6f916b
--- /dev/null
+++ b/client/ssh/handshake_test.go
@@ -0,0 +1,90 @@
+package ssh
+
+import (
+	"context"
+	"errors"
+	"net"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+	"golang.org/x/crypto/ssh"
+)
+
+func TestHandshake_ContextDeadlineWrapped(t *testing.T) {
+	conn := dialSilentServer(t)
+
+	ctx, cancel := context.WithTimeout(context.Background(), 50*time.Millisecond)
+	defer cancel()
+
+	_, err := Handshake(ctx, conn, conn.RemoteAddr().String(), testClientConfig())
+	require.Error(t, err)
+	require.True(t, errors.Is(err, context.DeadlineExceeded), "expected context.DeadlineExceeded, got: %v", err)
+}
+
+func TestHandshake_ContextCancelUnblocks(t *testing.T) {
+	conn := dialSilentServer(t)
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	time.AfterFunc(50*time.Millisecond, cancel)
+
+	errCh := make(chan error, 1)
+	go func() {
+		_, err := Handshake(ctx, conn, conn.RemoteAddr().String(), testClientConfig())
+		errCh <- err
+	}()
+
+	select {
+	case err := <-errCh:
+		require.Error(t, err)
+		require.True(t, errors.Is(err, context.Canceled), "expected context.Canceled, got: %v", err)
+	case <-time.After(5 * time.Second):
+		t.Fatal("handshake did not return after context cancellation")
+	}
+}
+
+func TestHandshake_NonContextErrorNotWrapped(t *testing.T) {
+	conn := dialSilentServer(t)
+	require.NoError(t, conn.Close())
+
+	_, err := Handshake(context.Background(), conn, conn.RemoteAddr().String(), testClientConfig())
+	require.Error(t, err)
+	require.False(t, errors.Is(err, context.Canceled))
+	require.False(t, errors.Is(err, context.DeadlineExceeded))
+}
+
+func testClientConfig() *ssh.ClientConfig {
+	return &ssh.ClientConfig{
+		User:            "test",
+		HostKeyCallback: ssh.InsecureIgnoreHostKey(),
+	}
+}
+
+// dialSilentServer returns a client conn to a server that accepts and never
+// sends anything, so the SSH handshake blocks until the context is done.
+func dialSilentServer(t *testing.T) net.Conn {
+	t.Helper()
+
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = listener.Close() })
+
+	done := make(chan struct{})
+	t.Cleanup(func() { close(done) })
+
+	go func() {
+		c, err := listener.Accept()
+		if err != nil {
+			return
+		}
+		defer func() { _ = c.Close() }()
+		<-done
+	}()
+
+	conn, err := net.Dial("tcp", listener.Addr().String())
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = conn.Close() })
+
+	return conn
+}
diff --git a/client/ui/autostart_default.go b/client/ui/autostart_default.go
index 162922579..0c67667dd 100644
--- a/client/ui/autostart_default.go
+++ b/client/ui/autostart_default.go
@@ -72,7 +72,7 @@ func netbirdFootprintExists() bool {
 // retrying autostart entry writes on every launch. A user's later disable in
 // Settings is never overridden: the marker guarantees at-most-once, ever.
 func applyAutostartDefault(ctx context.Context, autostart *services.Autostart, prefs *preferences.Store, prefsFileExisted bool) {
-	mdmDisabled := autostartDisabledByMDM(mdm.LoadPolicy())
+	mdmDisabled := autostartDisabledByMDM(mdm.NewLoader(nil).Load())
 
 	if mdmDisabled {
 		if enabled, err := autostart.IsEnabled(ctx); err != nil {
diff --git a/client/ui/frontend/index.html b/client/ui/frontend/index.html
index e62139956..f4c8b3d68 100644
--- a/client/ui/frontend/index.html
+++ b/client/ui/frontend/index.html
@@ -6,7 +6,25 @@
     <title>NetBird</title>
     <style>
       html, body { background: #181A1D; }
+      html:not(.dark), html:not(.dark) body { background: #F3F3F3; }
     </style>
+    <script>
+      // Pre-paint theme guard: apply the last-known theme before first render
+      // to avoid a flash of the wrong theme. ThemeContext keeps the mirror
+      // fresh from the persisted preference and the Go-reported OS appearance.
+      (function () {
+        try {
+          var pref = localStorage.getItem("nb-theme-pref") || "system";
+          var dark;
+          if (pref === "dark") dark = true;
+          else if (pref === "light") dark = false;
+          else dark = window.matchMedia("(prefers-color-scheme: dark)").matches;
+          document.documentElement.classList.toggle("dark", dark);
+        } catch (e) {
+          /* keep the default dark class */
+        }
+      })();
+    </script>
   </head>
   <body>
     <div id="root"></div>
diff --git a/client/ui/frontend/src/app.tsx b/client/ui/frontend/src/app.tsx
index 7f1359510..6accda36f 100644
--- a/client/ui/frontend/src/app.tsx
+++ b/client/ui/frontend/src/app.tsx
@@ -13,6 +13,7 @@ import { SkeletonTheme } from "react-loading-skeleton";
 import "react-loading-skeleton/dist/skeleton.css";
 import { welcome } from "@/lib/welcome";
 import LoginWaitingForBrowserDialog from "@/modules/login/LoginWaitingForBrowserDialog.tsx";
+import { ThemeProvider } from "@/contexts/ThemeContext.tsx";
 import { initI18n } from "@/lib/i18n";
 import { initPlatform } from "@/lib/platform";
 import { initLogForwarding } from "@/lib/logs";
@@ -35,30 +36,38 @@ Promise.all([
 ]).finally(() => {
     ReactDOM.createRoot(document.getElementById("root")!).render(
         <React.StrictMode>
-            <SkeletonTheme baseColor={"#25282d"} highlightColor={"#33373e"}>
-                <HashRouter>
-                    <Routes>
-                        <Route path={"dialog"}>
-                            <Route
-                                path={"browser-login"}
-                                element={<LoginWaitingForBrowserDialog />}
-                            />
-                            <Route path={"install-progress"} element={<UpdateInProgressDialog />} />
-                            <Route
-                                path={"session-expiration"}
-                                element={<SessionExpirationDialog />}
-                            />
-                            <Route path={"welcome"} element={<WelcomeDialog />} />
-                            <Route path={"error"} element={<ErrorDialog />} />
-                        </Route>
-                        <Route element={<AppLayout />}>
-                            <Route index element={<MainPage />} />
-                            <Route path={"settings"} element={<SettingsPage />} />
-                            <Route path={"*"} element={<Navigate to={"/"} replace />} />
-                        </Route>
-                    </Routes>
-                </HashRouter>
-            </SkeletonTheme>
+            <ThemeProvider>
+                <SkeletonTheme
+                    baseColor={"rgb(var(--skeleton-base))"}
+                    highlightColor={"rgb(var(--skeleton-highlight))"}
+                >
+                    <HashRouter>
+                        <Routes>
+                            <Route path={"dialog"}>
+                                <Route
+                                    path={"browser-login"}
+                                    element={<LoginWaitingForBrowserDialog />}
+                                />
+                                <Route
+                                    path={"install-progress"}
+                                    element={<UpdateInProgressDialog />}
+                                />
+                                <Route
+                                    path={"session-expiration"}
+                                    element={<SessionExpirationDialog />}
+                                />
+                                <Route path={"welcome"} element={<WelcomeDialog />} />
+                                <Route path={"error"} element={<ErrorDialog />} />
+                            </Route>
+                            <Route element={<AppLayout />}>
+                                <Route index element={<MainPage />} />
+                                <Route path={"settings"} element={<SettingsPage />} />
+                                <Route path={"*"} element={<Navigate to={"/"} replace />} />
+                            </Route>
+                        </Routes>
+                    </HashRouter>
+                </SkeletonTheme>
+            </ThemeProvider>
         </React.StrictMode>,
     );
 });
diff --git a/client/ui/frontend/src/assets/logos/netbird-full-light.svg b/client/ui/frontend/src/assets/logos/netbird-full-light.svg
new file mode 100644
index 000000000..3457b50c6
--- /dev/null
+++ b/client/ui/frontend/src/assets/logos/netbird-full-light.svg
@@ -0,0 +1,19 @@
+<svg width="133" height="23" viewBox="0 0 133 23" fill="none" xmlns="http://www.w3.org/2000/svg">
+<g clip-path="url(#clip0_0_3)">
+<path d="M46.9438 7.5013C48.1229 8.64688 48.7082 10.3025 48.7082 12.4683V21.6663H46.1411V12.8362C46.1411 11.2809 45.7481 10.0851 44.9704 9.26566C44.1928 8.43783 43.1308 8.0281 41.7846 8.0281C40.4383 8.0281 39.3345 8.45455 38.5234 9.30747C37.7123 10.1604 37.3109 11.4063 37.3109 13.0369V21.6663H34.7188V6.06305H37.3109V8.28732C37.821 7.49294 38.5234 6.87416 39.4014 6.43934C40.2878 6.00452 41.2578 5.78711 42.3197 5.78711C44.2179 5.78711 45.7565 6.36408 46.9355 7.50966L46.9438 7.5013Z" fill="#1f2124"/>
+<path d="M67.1048 14.8344H54.6288C54.7208 16.373 55.2476 17.5771 56.2092 18.4384C57.1708 19.2997 58.3331 19.7345 59.6961 19.7345C60.8166 19.7345 61.7531 19.4753 62.4973 18.9485C63.2499 18.4301 63.7767 17.7277 64.0777 16.858H66.8706C66.4525 18.3548 65.6163 19.5756 64.3621 20.5205C63.1078 21.4571 61.5525 21.9337 59.6878 21.9337C58.2077 21.9337 56.8865 21.5992 55.7159 20.9386C54.5452 20.278 53.6337 19.3331 52.9648 18.1039C52.2958 16.8831 51.9697 15.4616 51.9697 13.8477C51.9697 12.2339 52.2958 10.8207 52.9397 9.60825C53.5836 8.39578 54.495 7.45924 55.6573 6.80702C56.828 6.15479 58.1659 5.82031 59.6878 5.82031C61.2096 5.82031 62.4806 6.14643 63.6178 6.79029C64.7551 7.43416 65.6331 8.32052 66.2518 9.44938C66.8706 10.5782 67.18 11.8576 67.18 13.2791C67.18 13.7725 67.1549 14.2909 67.0964 14.8428L67.1048 14.8344ZM63.8603 10.1769C63.4255 9.4661 62.8318 8.92258 62.0793 8.55465C61.3267 8.18673 60.4989 8.00277 59.5874 8.00277C58.2746 8.00277 57.1625 8.42086 56.2427 9.25705C55.3228 10.0932 54.796 11.2472 54.6623 12.7356H64.5126C64.5126 11.7489 64.2952 10.896 63.8603 10.1852V10.1769Z" fill="#1f2124"/>
+<path d="M73.7695 8.20355V17.4016C73.7695 18.1626 73.9284 18.6977 74.2545 19.0071C74.5806 19.3165 75.1409 19.4754 75.9352 19.4754H77.8418V21.6662H75.5088C74.0622 21.6662 72.9835 21.3317 72.2644 20.6711C71.5452 20.0105 71.1857 18.9151 71.1857 17.3933V8.19519H69.1621V6.0629H71.1857V2.13281H73.7779V6.0629H77.8501V8.19519H73.7779L73.7695 8.20355Z" fill="#1f2124"/>
+<path d="M85.9022 6.68902C86.9307 6.10369 88.093 5.80266 89.4058 5.80266C90.8106 5.80266 92.0732 6.13714 93.1937 6.79773C94.3142 7.46668 95.2006 8.39485 95.8444 9.59896C96.4883 10.8031 96.8144 12.2079 96.8144 13.7966C96.8144 15.3854 96.4883 16.7818 95.8444 18.011C95.2006 19.2486 94.3142 20.2018 93.1854 20.8875C92.0565 21.5732 90.7939 21.916 89.4141 21.916C88.0344 21.916 86.8805 21.6234 85.8687 21.0297C84.8569 20.4443 84.0876 19.6918 83.5775 18.7803V21.6568H80.9854V0.601562H83.5775V8.97182C84.1127 8.04365 84.8904 7.28272 85.9105 6.69738L85.9022 6.68902ZM93.4529 10.7362C92.9763 9.86654 92.3408 9.19759 91.5297 8.74605C90.7186 8.29451 89.8322 8.06037 88.8706 8.06037C87.909 8.06037 87.0394 8.29451 86.2366 8.75441C85.4255 9.22268 84.7817 9.89163 84.2967 10.778C83.8117 11.6643 83.5692 12.6845 83.5692 13.8384C83.5692 14.9924 83.8117 16.046 84.2967 16.9323C84.7817 17.8187 85.4255 18.4877 86.2366 18.9559C87.0394 19.4242 87.9174 19.65 88.8706 19.65C89.8239 19.65 90.727 19.4158 91.5297 18.9559C92.3324 18.4877 92.9763 17.8187 93.4529 16.9323C93.9296 16.046 94.1637 15.0091 94.1637 13.8134C94.1637 12.6176 93.9296 11.6142 93.4529 10.7362Z" fill="#1f2124"/>
+<path d="M100.318 3.01864C99.9749 2.67581 99.8076 2.25771 99.8076 1.76436C99.8076 1.27101 99.9749 0.852913 100.318 0.510076C100.661 0.167238 101.079 0 101.572 0C102.065 0 102.45 0.167238 102.784 0.510076C103.119 0.852913 103.286 1.27101 103.286 1.76436C103.286 2.25771 103.119 2.67581 102.784 3.01864C102.45 3.36148 102.049 3.52872 101.572 3.52872C101.095 3.52872 100.661 3.36148 100.318 3.01864ZM102.826 6.06237V21.6657H100.234V6.06237H102.826Z" fill="#1f2124"/>
+<path d="M111.773 6.52155C112.617 6.0282 113.646 5.77734 114.867 5.77734V8.45315H114.181C111.28 8.45315 109.825 10.0252 109.825 13.1776V21.6649H107.232V6.06165H109.825V8.5953C110.276 7.70058 110.928 7.00654 111.773 6.51319V6.52155Z" fill="#1f2124"/>
+<path d="M117.861 9.60732C118.505 8.40321 119.391 7.46668 120.52 6.80609C121.649 6.1455 122.92 5.81102 124.325 5.81102C125.537 5.81102 126.666 6.09533 127.711 6.64721C128.757 7.20746 129.551 7.94331 130.103 8.85475V0.601562H132.72V21.6735H130.103V18.7385C129.593 19.6667 128.832 20.436 127.828 21.0297C126.825 21.6317 125.646 21.9244 124.3 21.9244C122.953 21.9244 121.657 21.5816 120.528 20.8959C119.4 20.2102 118.513 19.257 117.869 18.0194C117.226 16.7818 116.899 15.377 116.899 13.805C116.899 12.233 117.226 10.8114 117.869 9.60732H117.861ZM129.392 10.7613C128.915 9.89163 128.28 9.22268 127.469 8.75441C126.658 8.28614 125.771 8.06037 124.81 8.06037C123.848 8.06037 122.962 8.28614 122.159 8.74605C121.356 9.20595 120.729 9.86654 120.253 10.7362C119.776 11.6058 119.542 12.6343 119.542 13.8134C119.542 14.9924 119.776 16.046 120.253 16.9323C120.729 17.8187 121.365 18.4877 122.159 18.9559C122.953 19.4242 123.84 19.65 124.81 19.65C125.78 19.65 126.666 19.4158 127.469 18.9559C128.272 18.4877 128.915 17.8187 129.392 16.9323C129.869 16.046 130.103 15.0175 130.103 13.8384C130.103 12.6594 129.869 11.6393 129.392 10.7613Z" fill="#1f2124"/>
+<path d="M21.4651 0.568359C17.8193 0.902835 16.0047 3.00167 15.3191 4.06363L4.66602 22.5183H17.5182L30.1949 0.568359H21.4651Z" fill="#F68330"/>
+<path d="M17.5265 22.5187L0 3.9302C0 3.9302 19.8177 -1.39633 21.7493 15.2188L17.5265 22.5187Z" fill="#F68330"/>
+<path d="M14.9255 4.75055L9.54883 14.0657L17.5177 22.5196L21.7405 15.2029C21.0715 9.49174 18.287 6.37276 14.9255 4.74219" fill="#F35E32"/>
+</g>
+<defs>
+<clipPath id="clip0_0_3">
+<rect width="132.72" height="22.5186" fill="white"/>
+</clipPath>
+</defs>
+</svg>
diff --git a/client/ui/frontend/src/components/Badge.tsx b/client/ui/frontend/src/components/Badge.tsx
index c5e2b5f22..a6f2e886a 100644
--- a/client/ui/frontend/src/components/Badge.tsx
+++ b/client/ui/frontend/src/components/Badge.tsx
@@ -11,12 +11,14 @@ type Props = HTMLAttributes<HTMLSpanElement> & {
 };
 
 const VARIANT_CLASSES: Record<BadgeVariant, string> = {
-    info: "bg-sky-900 border border-sky-700 text-sky-200",
+    info: "bg-sky-100 border border-sky-300 text-sky-800 dark:bg-sky-900 dark:border-sky-700 dark:text-sky-200",
     neutral: "bg-nb-gray-900 border border-nb-gray-850 text-nb-gray-200",
-    brand: "bg-netbird/15 border border-netbird/30 text-netbird",
-    success: "bg-green-900 border border-green-700 text-green-200",
-    warning: "bg-yellow-900 border border-yellow-700 text-yellow-200",
-    danger: "bg-red-900 border border-red-700 text-red-200",
+    brand: "bg-netbird/15 border border-netbird/30 text-netbird-700 dark:text-netbird",
+    success:
+        "bg-green-100 border border-green-300 text-green-800 dark:bg-green-900 dark:border-green-700 dark:text-green-200",
+    warning:
+        "bg-yellow-100 border border-yellow-300 text-yellow-800 dark:bg-yellow-900 dark:border-yellow-700 dark:text-yellow-200",
+    danger: "bg-red-100 border border-red-300 text-red-800 dark:bg-red-900 dark:border-red-700 dark:text-red-200",
 };
 
 export const Badge = forwardRef<HTMLSpanElement, Props>(function Badge(
diff --git a/client/ui/frontend/src/components/CopyToClipboard.tsx b/client/ui/frontend/src/components/CopyToClipboard.tsx
index 3cf681a1c..4af4ecc8f 100644
--- a/client/ui/frontend/src/components/CopyToClipboard.tsx
+++ b/client/ui/frontend/src/components/CopyToClipboard.tsx
@@ -81,7 +81,7 @@ export const CopyToClipboard = ({
             aria-live={"polite"}
             className={cn(
                 "group/copy wails-no-draggable pointer-events-auto inline-flex cursor-default items-center gap-2 rounded-sm text-left outline-none",
-                "focus-visible:ring-2 focus-visible:ring-white/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940",
+                "focus-visible:ring-2 focus-visible:ring-nb-gray-50/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940",
                 className,
             )}
         >
diff --git a/client/ui/frontend/src/components/DropdownMenu.tsx b/client/ui/frontend/src/components/DropdownMenu.tsx
index d43c37e1b..8cedcea03 100644
--- a/client/ui/frontend/src/components/DropdownMenu.tsx
+++ b/client/ui/frontend/src/components/DropdownMenu.tsx
@@ -16,7 +16,7 @@ const menuItemVariants = cva("", {
         variant: {
             default:
                 "text-nb-gray-200 hover:bg-nb-gray-900 hover:text-nb-gray-50 focus-visible:bg-nb-gray-900 focus-visible:text-nb-gray-50 data-[state=open]:bg-nb-gray-900 data-[state=open]:text-nb-gray-50",
-            danger: "text-red-500 hover:bg-red-900/20 hover:text-red-500 focus-visible:bg-red-900/20 focus-visible:text-red-500",
+            danger: "text-red-500 hover:bg-red-500/10 hover:text-red-500 focus-visible:bg-red-500/10 focus-visible:text-red-500 dark:hover:bg-red-900/20 dark:focus-visible:bg-red-900/20",
         },
     },
     defaultVariants: { variant: "default" },
diff --git a/client/ui/frontend/src/components/LanguagePicker.tsx b/client/ui/frontend/src/components/LanguagePicker.tsx
index 7a30f8b33..35ef7d5b5 100644
--- a/client/ui/frontend/src/components/LanguagePicker.tsx
+++ b/client/ui/frontend/src/components/LanguagePicker.tsx
@@ -97,9 +97,9 @@ export function LanguagePicker() {
                                 "rounded-md border bg-white dark:bg-nb-gray-900",
                                 "border-neutral-200 dark:border-nb-gray-700",
                                 "cursor-default text-xs font-semibold text-nb-gray-100 outline-none",
-                                "hover:border-nb-gray-600 data-[state=open]:border-nb-gray-600",
+                                "hover:border-nb-gray-700 data-[state=open]:border-nb-gray-700 dark:hover:border-nb-gray-600 dark:data-[state=open]:border-nb-gray-600",
                                 isFocusVisible &&
-                                    "focus-visible:ring-2 focus-visible:ring-white/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940",
+                                    "focus-visible:ring-2 focus-visible:ring-nb-gray-50/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940",
                                 "disabled:opacity-50",
                             )}
                         >
@@ -157,7 +157,7 @@ export function LanguagePicker() {
                                             placeholder={t("settings.general.language.search")}
                                             aria-label={t("settings.general.language.search")}
                                             className={cn(
-                                                "w-full bg-transparent text-xs text-nb-gray-100 placeholder:text-nb-gray-300",
+                                                "w-full bg-transparent text-xs text-nb-gray-100 placeholder:text-nb-gray-600 dark:placeholder:text-nb-gray-300",
                                                 "border-none outline-none",
                                             )}
                                         />
diff --git a/client/ui/frontend/src/components/SquareIcon.tsx b/client/ui/frontend/src/components/SquareIcon.tsx
index e904d2de5..aaf3b1100 100644
--- a/client/ui/frontend/src/components/SquareIcon.tsx
+++ b/client/ui/frontend/src/components/SquareIcon.tsx
@@ -5,7 +5,7 @@ import { cn } from "@/lib/cn";
 export type SquareIconVariant = "default" | "info" | "warning" | "danger";
 
 const variantClass: Record<SquareIconVariant, string> = {
-    default: "text-white",
+    default: "text-nb-gray-50",
     info: "text-sky-400",
     warning: "text-netbird",
     danger: "text-red-500",
@@ -27,7 +27,7 @@ export const SquareIcon = ({
     <div
         aria-hidden={"true"}
         className={cn(
-            "flex h-11 w-11 items-center justify-center rounded-lg border border-nb-gray-900 bg-nb-gray-920",
+            "flex h-11 w-11 items-center justify-center rounded-lg border border-nb-gray-800 bg-nb-gray-920 dark:border-nb-gray-900",
             variantClass[variant],
             className,
         )}
diff --git a/client/ui/frontend/src/components/ThemePicker.tsx b/client/ui/frontend/src/components/ThemePicker.tsx
new file mode 100644
index 000000000..c3dc70d1e
--- /dev/null
+++ b/client/ui/frontend/src/components/ThemePicker.tsx
@@ -0,0 +1,109 @@
+import { useState } from "react";
+import { useTranslation } from "react-i18next";
+import { ChevronDown, MonitorIcon, MoonIcon, SunMediumIcon, type LucideIcon } from "lucide-react";
+import {
+    DropdownMenu,
+    DropdownMenuContent,
+    DropdownMenuRadioGroup,
+    DropdownMenuRadioItem,
+    DropdownMenuTrigger,
+} from "@/components/DropdownMenu";
+import { HelpText } from "@/components/typography/HelpText";
+import { Label } from "@/components/typography/Label";
+import { useTheme, type ThemePreference } from "@/contexts/ThemeContext";
+import { useFocusVisible } from "@/hooks/useFocusVisible";
+import { cn } from "@/lib/cn";
+import { errorDialog, formatErrorMessage } from "@/lib/errors";
+
+const OPTIONS: { value: ThemePreference; icon: LucideIcon; labelKey: string }[] = [
+    { value: "system", icon: MonitorIcon, labelKey: "settings.general.theme.system" },
+    { value: "light", icon: SunMediumIcon, labelKey: "settings.general.theme.light" },
+    { value: "dark", icon: MoonIcon, labelKey: "settings.general.theme.dark" },
+];
+
+export function ThemePicker() {
+    const { t } = useTranslation();
+    const { theme, setTheme } = useTheme();
+    const [busy, setBusy] = useState(false);
+    const isFocusVisible = useFocusVisible();
+
+    const current = OPTIONS.find((o) => o.value === theme) ?? OPTIONS[0];
+    const CurrentIcon = current.icon;
+
+    const select = async (value: string) => {
+        if (busy || value === theme) return;
+        setBusy(true);
+        try {
+            await setTheme(value as ThemePreference);
+        } catch (e) {
+            await errorDialog({
+                Title: t("settings.error.saveTitle"),
+                Message: formatErrorMessage(e),
+            });
+        } finally {
+            setBusy(false);
+        }
+    };
+
+    return (
+        <div className={"flex items-center justify-between gap-6"}>
+            <div className={"max-w-md flex-1"}>
+                <Label as={"div"}>{t("settings.general.theme.label")}</Label>
+                <HelpText margin={false}>{t("settings.general.theme.help")}</HelpText>
+            </div>
+            <div className={"shrink-0"}>
+                <DropdownMenu>
+                    <DropdownMenuTrigger asChild>
+                        <button
+                            type={"button"}
+                            tabIndex={0}
+                            disabled={busy}
+                            aria-label={t("settings.general.theme.label")}
+                            className={cn(
+                                "inline-flex h-[40px] min-w-[160px] items-center gap-2 px-3",
+                                "rounded-md border bg-white dark:bg-nb-gray-900",
+                                "border-neutral-200 dark:border-nb-gray-700",
+                                "cursor-default text-xs font-semibold text-nb-gray-100 outline-none",
+                                "hover:border-nb-gray-700 data-[state=open]:border-nb-gray-700 dark:hover:border-nb-gray-600 dark:data-[state=open]:border-nb-gray-600",
+                                isFocusVisible &&
+                                    "focus-visible:ring-2 focus-visible:ring-nb-gray-50/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940",
+                                "disabled:opacity-50",
+                            )}
+                        >
+                            <CurrentIcon
+                                size={16}
+                                aria-hidden={"true"}
+                                className={"shrink-0 text-nb-gray-200"}
+                            />
+                            <span className={"flex-1 truncate text-left"}>
+                                {t(current.labelKey)}
+                            </span>
+                            <ChevronDown
+                                size={12}
+                                aria-hidden={"true"}
+                                className={"shrink-0 text-nb-gray-400"}
+                            />
+                        </button>
+                    </DropdownMenuTrigger>
+                    <DropdownMenuContent
+                        align={"end"}
+                        className={"w-[var(--radix-dropdown-menu-trigger-width)]"}
+                    >
+                        <DropdownMenuRadioGroup value={theme} onValueChange={(v) => void select(v)}>
+                            {OPTIONS.map(({ value, icon: Icon, labelKey }) => (
+                                <DropdownMenuRadioItem key={value} value={value}>
+                                    <Icon
+                                        size={14}
+                                        aria-hidden={"true"}
+                                        className={"mr-2 shrink-0 text-nb-gray-300"}
+                                    />
+                                    {t(labelKey)}
+                                </DropdownMenuRadioItem>
+                            ))}
+                        </DropdownMenuRadioGroup>
+                    </DropdownMenuContent>
+                </DropdownMenu>
+            </div>
+        </div>
+    );
+}
diff --git a/client/ui/frontend/src/components/Tooltip.tsx b/client/ui/frontend/src/components/Tooltip.tsx
index 2c77ba139..d7a85277a 100644
--- a/client/ui/frontend/src/components/Tooltip.tsx
+++ b/client/ui/frontend/src/components/Tooltip.tsx
@@ -81,12 +81,12 @@ export const Tooltip = ({
                         onPointerLeave={interactive ? scheduleClose : undefined}
                         onPointerDownOutside={interactive ? undefined : (e) => e.preventDefault()}
                         className={cn(
-                            "z-50 select-none text-xs text-nb-gray-100 shadow-lg",
+                            "z-50 select-none text-xs text-nb-gray-100 shadow-sm dark:shadow-lg",
                             "data-[state=delayed-open]:animate-in data-[state=closed]:animate-out",
                             "data-[state=closed]:fade-out-0 data-[state=delayed-open]:fade-in-0",
                             !interactive && "pointer-events-none",
                             contentClassName ??
-                                "rounded-md border border-nb-gray-850 bg-nb-gray-900 px-2 py-1",
+                                "rounded-md border border-nb-gray-800 bg-white px-2 py-1 dark:border-nb-gray-850 dark:bg-nb-gray-900",
                         )}
                     >
                         {content}
diff --git a/client/ui/frontend/src/components/VerticalTabs.tsx b/client/ui/frontend/src/components/VerticalTabs.tsx
index 1aedf82a6..306850ee2 100644
--- a/client/ui/frontend/src/components/VerticalTabs.tsx
+++ b/client/ui/frontend/src/components/VerticalTabs.tsx
@@ -46,12 +46,12 @@ const Trigger = forwardRef<HTMLButtonElement, TriggerProps>(function VerticalTab
         <Tabs.Trigger
             ref={ref}
             className={cn(
-                "group flex w-full cursor-default items-center gap-3 rounded-lg px-2 py-2.5 text-left outline-none",
+                "group flex w-full cursor-default items-center gap-3 rounded-md border border-transparent px-2 py-2.5 text-left outline-none dark:border-0",
                 "transition-colors duration-150",
-                "data-[state=active]:bg-nb-gray-930",
-                "data-[state=inactive]:hover:bg-nb-gray-935",
+                "data-[state=active]:border-nb-gray-800 data-[state=active]:bg-white dark:data-[state=active]:bg-nb-gray-930",
+                "data-[state=inactive]:hover:bg-nb-gray-850 dark:data-[state=inactive]:hover:bg-nb-gray-935",
                 isFocusVisible &&
-                    "focus-visible:ring-2 focus-visible:ring-white/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940",
+                    "focus-visible:ring-2 focus-visible:ring-nb-gray-50/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940",
                 className,
             )}
             {...props}
@@ -61,13 +61,15 @@ const Trigger = forwardRef<HTMLButtonElement, TriggerProps>(function VerticalTab
                 aria-hidden={"true"}
                 className={cn(
                     "ml-2 shrink-0 transition-colors duration-150",
-                    "text-nb-gray-400 group-data-[state=active]:text-nb-gray-100",
+                    "text-nb-gray-350 dark:text-nb-gray-400",
+                    "group-data-[state=active]:text-nb-gray-100",
                 )}
             />
             <span
                 className={cn(
                     "min-w-0 truncate text-sm font-medium transition-colors duration-150",
-                    "text-nb-gray-400 group-data-[state=active]:text-nb-gray-100",
+                    "text-nb-gray-350 dark:text-nb-gray-400",
+                    "group-data-[state=active]:font-semibold group-data-[state=active]:text-nb-gray-100 dark:group-data-[state=active]:font-medium",
                 )}
             >
                 {title}
diff --git a/client/ui/frontend/src/components/buttons/Button.tsx b/client/ui/frontend/src/components/buttons/Button.tsx
index 6b151c17b..931988ead 100644
--- a/client/ui/frontend/src/components/buttons/Button.tsx
+++ b/client/ui/frontend/src/components/buttons/Button.tsx
@@ -24,71 +24,74 @@ const buttonVariants = cva(
         variants: {
             variant: {
                 default: [
-                    "border-gray-200 bg-white text-gray-900 hover:bg-gray-100 hover:text-black focus:ring-zinc-200/50",
-                    "dark:border-gray-700/30 dark:bg-nb-gray dark:text-gray-400 dark:hover:bg-zinc-800/50 dark:hover:text-white dark:focus:ring-zinc-800/50",
+                    "border-neutral-200 bg-white text-neutral-900 hover:bg-neutral-100 hover:text-black focus:ring-neutral-200/50",
+                    "dark:border-gray-700/30 dark:bg-nb-gray dark:text-gray-400 dark:hover:bg-zinc-800/50 dark:hover:text-nb-gray-50 dark:focus:ring-zinc-800/50",
                 ],
                 primary: [
-                    "dark:text-gray-100 dark:ring-offset-neutral-950/50 dark:focus:ring-netbird-600/50 enabled:dark:bg-netbird enabled:dark:hover:bg-netbird-500/80 enabled:dark:hover:text-white disabled:dark:bg-nb-gray-900",
-                    "enabled:bg-netbird enabled:text-white enabled:hover:bg-netbird-500 enabled:focus:ring-netbird-400/50",
+                    "dark:text-gray-100 dark:ring-offset-neutral-950/50 dark:focus:ring-netbird-600/50 enabled:dark:bg-netbird enabled:dark:hover:bg-netbird-500/80 enabled:dark:hover:text-nb-gray-50 disabled:dark:bg-nb-gray-900",
+                    "enabled:bg-netbird enabled:text-white enabled:hover:bg-netbird-500 enabled:focus:ring-netbird-400/50 disabled:bg-nb-gray-700",
                 ],
                 secondary: [
-                    "border-gray-200 bg-white text-gray-900 hover:bg-gray-100 hover:text-black focus:ring-zinc-200/50",
-                    "dark:ring-offset-neutral-950/50 dark:focus:ring-neutral-500/20",
-                    "dark:border-gray-700/40 dark:bg-nb-gray-920 dark:text-gray-400 dark:hover:bg-nb-gray-910 dark:hover:text-white",
+                    "border-neutral-200 bg-white text-neutral-900 hover:border-nb-gray-700 hover:bg-nb-gray-950 hover:text-black focus:ring-nb-gray-500/50 focus:ring-offset-0",
+                    "dark:ring-offset-neutral-950/50 dark:focus:ring-neutral-500/20 dark:focus:ring-offset-1",
+                    "dark:border-gray-700/40 dark:bg-nb-gray-920 dark:text-gray-400 dark:hover:border-gray-700/40 dark:hover:bg-nb-gray-910 dark:hover:text-nb-gray-50",
                 ],
                 secondaryLighter: [
-                    "border-gray-200 bg-white text-gray-900 hover:bg-gray-100 hover:text-black focus:ring-zinc-200/50",
+                    "border-neutral-200 bg-white text-neutral-900 hover:bg-neutral-100 hover:text-black focus:ring-neutral-200/50",
                     "dark:ring-offset-neutral-950/50 dark:focus:ring-neutral-500/20",
-                    "dark:border-gray-700/70 dark:bg-nb-gray-900/70 dark:text-gray-400 dark:hover:bg-nb-gray-800/60 dark:hover:text-white",
+                    "dark:border-gray-700/70 dark:bg-nb-gray-900/70 dark:text-gray-400 dark:hover:bg-nb-gray-800/60 dark:hover:text-nb-gray-50",
                 ],
                 subtle: [
-                    "border-nb-gray-200 bg-nb-gray-50 text-nb-gray-900 hover:bg-nb-gray-100 focus:ring-nb-gray-200/60",
+                    "border-neutral-200 bg-neutral-50 text-neutral-900 hover:bg-neutral-100 focus:ring-neutral-200/60",
                     "dark:ring-offset-neutral-950/50 dark:focus:ring-nb-gray-200/40",
                     "dark:border-nb-gray-200 dark:bg-nb-gray-50 dark:text-nb-gray-900 dark:hover:bg-nb-gray-100 dark:hover:text-nb-gray-950",
                 ],
                 input: [
-                    "border-neutral-200 bg-white text-gray-900 hover:bg-gray-100 hover:text-black focus:ring-zinc-200/50",
+                    "border-neutral-200 bg-white text-neutral-900 hover:bg-neutral-100 hover:text-black focus:ring-neutral-200/50",
                     "dark:ring-offset-neutral-950/50 dark:focus:ring-neutral-500/20",
                     "dark:border-nb-gray-700 dark:bg-nb-gray-900 dark:text-gray-400 dark:hover:bg-nb-gray-900/80",
                 ],
                 dropdown: [
-                    "border-neutral-200 bg-white text-gray-900 hover:bg-gray-100 hover:text-black focus:ring-zinc-200/50",
+                    "border-neutral-200 bg-white text-neutral-900 hover:bg-neutral-100 hover:text-black focus:ring-neutral-200/50",
                     "dark:ring-offset-neutral-950/50 dark:focus:ring-neutral-500/20",
                     "dark:border-nb-gray-900 dark:bg-nb-gray-900/40 dark:text-gray-400 dark:hover:bg-nb-gray-900/50",
                 ],
                 dotted: [
-                    "border-dashed border-gray-200 bg-white text-gray-900 hover:bg-gray-100 hover:text-black focus:ring-zinc-200/50",
+                    "border-dashed border-neutral-200 bg-white text-neutral-900 hover:bg-neutral-100 hover:text-black focus:ring-neutral-200/50",
                     "dark:ring-offset-neutral-950/50 dark:focus:ring-neutral-500/20",
-                    "dark:border-gray-500/40 dark:bg-nb-gray-900/30 dark:text-gray-400 dark:hover:bg-nb-gray-900/50 dark:hover:text-white",
+                    "dark:border-gray-500/40 dark:bg-nb-gray-900/30 dark:text-gray-400 dark:hover:bg-nb-gray-900/50 dark:hover:text-nb-gray-50",
                 ],
                 tertiary: [
-                    "border-gray-200 bg-white text-gray-900 hover:bg-gray-100 hover:text-black focus:ring-zinc-200/50",
+                    "border-neutral-200 bg-white text-neutral-900 hover:bg-neutral-100 hover:text-black focus:ring-neutral-200/50",
                     "dark:border-gray-700/40 dark:bg-white dark:text-gray-800 dark:hover:bg-neutral-200 dark:focus:ring-zinc-800/50 disabled:dark:bg-nb-gray-920 disabled:dark:text-nb-gray-300",
                 ],
                 white: [
-                    "border-white bg-white text-gray-800 outline-none hover:bg-neutral-200 focus:ring-white/50 disabled:dark:bg-nb-gray-920 disabled:dark:text-nb-gray-300",
+                    "border-white bg-white text-neutral-800 outline-none hover:bg-neutral-200 focus:ring-white/50 dark:text-gray-800 disabled:dark:bg-nb-gray-920 disabled:dark:text-nb-gray-300",
                     "disabled:dark:border-nb-gray-900 disabled:dark:bg-nb-gray-900 disabled:dark:text-nb-gray-300",
                 ],
                 outline: [
-                    "border-gray-200 bg-white text-gray-900 hover:bg-gray-100 hover:text-black focus:ring-zinc-200/50",
+                    "border-neutral-200 bg-white text-neutral-900 hover:bg-neutral-100 hover:text-black focus:ring-neutral-200/50",
                     "dark:border-netbird dark:bg-transparent dark:text-netbird dark:hover:bg-nb-gray-900/30 dark:focus:ring-zinc-800/50",
                 ],
                 "danger-outline": [
+                    "bg-transparent text-red-600 enabled:hover:bg-red-50 enabled:focus:ring-red-200/50",
                     "dark:bg-transparent dark:text-red-500 enabled:dark:hover:border-red-800/50 enabled:hover:dark:bg-red-950/50 enabled:dark:focus:bg-red-950/40 enabled:dark:focus:ring-red-800/20",
                 ],
                 "danger-text": [
-                    "rounded-sm !px-0 !py-0 !shadow-none focus:ring-red-500/30 dark:border-transparent dark:bg-transparent dark:text-red-500 dark:ring-offset-neutral-950/50 dark:hover:text-red-600",
+                    "rounded-sm border-transparent bg-transparent !px-0 !py-0 text-red-600 !shadow-none hover:text-red-700 focus:ring-red-500/30",
+                    "dark:border-transparent dark:bg-transparent dark:text-red-500 dark:ring-offset-neutral-950/50 dark:hover:text-red-600",
                 ],
                 "default-outline": [
-                    "dark:ring-offset-nb-gray-950/50 dark:focus:ring-nb-gray-500/20",
-                    "dark:border-transparent dark:bg-transparent dark:text-nb-gray-400 dark:hover:border-nb-gray-800/50 dark:hover:bg-nb-gray-900/30 dark:hover:text-white",
-                    "data-[state=open]:dark:border-nb-gray-800/50 data-[state=open]:dark:bg-nb-gray-900/30 data-[state=open]:dark:text-white",
+                    "ring-offset-nb-gray-950/50 focus:ring-nb-gray-500/20",
+                    "border-transparent bg-transparent text-nb-gray-400 hover:border-nb-gray-800/50 hover:bg-nb-gray-900/30 hover:text-nb-gray-50",
+                    "data-[state=open]:border-nb-gray-800/50 data-[state=open]:bg-nb-gray-900/30 data-[state=open]:text-nb-gray-50",
                 ],
                 ghost: [
-                    "dark:ring-offset-nb-gray-950/50 dark:focus:ring-nb-gray-500/20",
-                    "dark:border-transparent dark:bg-transparent dark:text-nb-gray-400 dark:hover:bg-nb-gray-900/30 dark:hover:text-white",
+                    "ring-offset-nb-gray-950/50 focus:ring-nb-gray-500/20",
+                    "border-transparent bg-transparent text-nb-gray-400 hover:bg-nb-gray-900/30 hover:text-nb-gray-50",
                 ],
                 danger: [
+                    "bg-red-600 text-red-50 hover:bg-red-700 focus:bg-red-700 focus:ring-red-700/20",
                     "dark:bg-red-600 dark:text-red-100 dark:hover:border-red-800/50 hover:dark:bg-red-700 dark:focus:bg-red-700 dark:focus:ring-red-700/20",
                 ],
             },
diff --git a/client/ui/frontend/src/components/buttons/IconButton.tsx b/client/ui/frontend/src/components/buttons/IconButton.tsx
index 3d36bc111..8d688cb0b 100644
--- a/client/ui/frontend/src/components/buttons/IconButton.tsx
+++ b/client/ui/frontend/src/components/buttons/IconButton.tsx
@@ -24,7 +24,7 @@ export const IconButton = forwardRef<HTMLButtonElement, Props>(function IconButt
                 "flex h-10 w-10 cursor-default items-center justify-center rounded-lg outline-none",
                 "text-nb-gray-400 hover:bg-nb-gray-900 hover:text-nb-gray-300",
                 isFocusVisible &&
-                    "focus-visible:ring-2 focus-visible:ring-white/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940",
+                    "focus-visible:ring-2 focus-visible:ring-nb-gray-50/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940",
                 "wails-no-draggable transition-colors duration-150",
                 className,
             )}
diff --git a/client/ui/frontend/src/components/dialog/Dialog.tsx b/client/ui/frontend/src/components/dialog/Dialog.tsx
index fa8007d9f..c43c04b0b 100644
--- a/client/ui/frontend/src/components/dialog/Dialog.tsx
+++ b/client/ui/frontend/src/components/dialog/Dialog.tsx
@@ -23,7 +23,7 @@ const Overlay = forwardRef<ElementRef<typeof DialogPrimitive.Overlay>, OverlayPr
                 ref={ref}
                 className={cn(
                     "fixed inset-0 z-50 grid items-center justify-items-center overflow-y-auto px-10 py-16",
-                    "bg-black/60",
+                    "bg-black/25 dark:bg-black/60",
                     "data-[state=open]:animate-in data-[state=open]:fade-in-0",
                     exitAnimation &&
                         "data-[state=closed]:animate-out data-[state=closed]:fade-out-0",
@@ -67,7 +67,7 @@ export const Content = forwardRef<ElementRef<typeof DialogPrimitive.Content>, Co
                         className={cn(
                             "relative z-[52] mx-auto w-full outline-none ring-0",
                             "focus:outline-none focus:ring-0 focus-visible:outline-none focus-visible:ring-0",
-                            "rounded-lg border border-nb-gray-900 bg-nb-gray py-7 shadow-2xl",
+                            "rounded-lg border border-nb-gray-800 bg-nb-gray-940 py-7 shadow-2xl dark:border-nb-gray-900 dark:bg-nb-gray",
                             "data-[state=open]:animate-in data-[state=open]:fade-in-0",
                             "data-[state=open]:zoom-in-95 data-[state=open]:slide-in-from-left-1",
                             exitAnimation &&
diff --git a/client/ui/frontend/src/components/inputs/Input.tsx b/client/ui/frontend/src/components/inputs/Input.tsx
index 2dad80d7a..eada79a1f 100644
--- a/client/ui/frontend/src/components/inputs/Input.tsx
+++ b/client/ui/frontend/src/components/inputs/Input.tsx
@@ -32,19 +32,19 @@ const inputVariants = cva("", {
     variants: {
         variant: {
             default: [
-                "border-neutral-200 placeholder:text-neutral-500 dark:border-nb-gray-700 dark:bg-nb-gray-900 dark:placeholder:text-neutral-400/70",
+                "border-neutral-200 placeholder:text-nb-gray-600 dark:border-nb-gray-700 dark:bg-nb-gray-900 dark:placeholder:text-neutral-400/70",
                 "ring-offset-neutral-200/20 focus-visible:ring-neutral-300/10 dark:ring-offset-neutral-950/50 dark:focus-visible:ring-neutral-500/20",
             ],
             darker: [
-                "border-neutral-300 placeholder:text-neutral-500 dark:border-nb-gray-800 dark:bg-nb-gray-920 dark:placeholder:text-neutral-400/70",
+                "border-neutral-300 placeholder:text-nb-gray-600 dark:border-nb-gray-800 dark:bg-nb-gray-920 dark:placeholder:text-neutral-400/70",
                 "ring-offset-neutral-200/20 focus-visible:ring-neutral-300/10 dark:ring-offset-neutral-950/50 dark:focus-visible:ring-neutral-500/20",
             ],
             error: [
-                "border-neutral-200 text-red-500 placeholder:text-neutral-500 dark:border-red-500 dark:bg-nb-gray-900 dark:placeholder:text-neutral-400/70",
+                "border-neutral-200 text-red-500 placeholder:text-nb-gray-600 dark:border-red-500 dark:bg-nb-gray-900 dark:placeholder:text-neutral-400/70",
                 "ring-offset-red-500/10 focus-visible:ring-red-500/10 dark:ring-offset-red-500/10 dark:focus-visible:ring-red-500/10",
             ],
             warning: [
-                "border-neutral-200 text-orange-400 placeholder:text-neutral-500 dark:border-orange-400 dark:bg-nb-gray-900 dark:placeholder:text-neutral-400/70",
+                "border-neutral-200 text-orange-400 placeholder:text-nb-gray-600 dark:border-orange-400 dark:bg-nb-gray-900 dark:placeholder:text-neutral-400/70",
                 "ring-offset-orange-400/10 focus-visible:ring-orange-400/10 dark:ring-offset-orange-400/10 dark:focus-visible:ring-orange-400/10",
             ],
         },
@@ -158,7 +158,7 @@ function NumberStepper({
             className={cn(
                 "flex h-[40px] shrink-0 flex-col overflow-hidden",
                 "rounded-r-md border border-l-0",
-                "border-neutral-200 dark:border-nb-gray-700 dark:bg-nb-gray-900",
+                "border-neutral-200 bg-white dark:border-nb-gray-700 dark:bg-nb-gray-900",
                 error && "dark:border-red-500",
                 disabled && "pointer-events-none opacity-40",
             )}
@@ -274,7 +274,9 @@ export const Input = forwardRef<HTMLInputElement, InputProps>(function Input(
             <button
                 type={"button"}
                 onClick={() => setShowPassword((s) => !s)}
-                className={"pointer-events-auto transition-all hover:text-white"}
+                className={
+                    "pointer-events-auto text-nb-gray-400 transition-colors hover:text-nb-gray-50 dark:text-nb-gray-300 dark:hover:text-nb-gray-50"
+                }
                 aria-label={t("common.togglePasswordVisibility")}
                 aria-pressed={showPassword}
             >
@@ -303,7 +305,9 @@ export const Input = forwardRef<HTMLInputElement, InputProps>(function Input(
         <button
             type={"button"}
             onClick={onCopy}
-            className={"pointer-events-auto transition-all hover:text-white"}
+            className={
+                "pointer-events-auto text-nb-gray-400 transition-colors hover:text-nb-gray-50 dark:text-nb-gray-300 dark:hover:text-nb-gray-50"
+            }
             aria-label={t("common.copy")}
         >
             {copied ? (
diff --git a/client/ui/frontend/src/components/inputs/SearchInput.tsx b/client/ui/frontend/src/components/inputs/SearchInput.tsx
index 5f46e8fba..e6d9ef4b6 100644
--- a/client/ui/frontend/src/components/inputs/SearchInput.tsx
+++ b/client/ui/frontend/src/components/inputs/SearchInput.tsx
@@ -33,7 +33,7 @@ export const SearchInput = forwardRef<HTMLInputElement, Props>(function SearchIn
                 spellCheck={false}
                 {...props}
                 className={cn(
-                    "w-full bg-transparent text-sm text-nb-gray-200 placeholder:text-nb-gray-400",
+                    "w-full bg-transparent text-sm text-nb-gray-200 placeholder:text-nb-gray-600 dark:placeholder:text-nb-gray-400",
                     "border-none outline-none",
                     disabled && "cursor-not-allowed",
                     className,
diff --git a/client/ui/frontend/src/components/switches/FancyToggleSwitch.tsx b/client/ui/frontend/src/components/switches/FancyToggleSwitch.tsx
index 45e3e333a..a63e56e69 100644
--- a/client/ui/frontend/src/components/switches/FancyToggleSwitch.tsx
+++ b/client/ui/frontend/src/components/switches/FancyToggleSwitch.tsx
@@ -36,7 +36,7 @@ export default function FancyToggleSwitch({
 
     if (loading) {
         const shimmer =
-            "text-transparent select-none rounded bg-[#25282d] box-decoration-clone animate-pulse";
+            "text-transparent select-none rounded bg-nb-gray-920 box-decoration-clone animate-pulse";
         return (
             <div
                 role={"status"}
@@ -58,7 +58,9 @@ export default function FancyToggleSwitch({
                     <div className={"mt-2 pr-1"}>
                         <div
                             aria-hidden={"true"}
-                            className={"h-[24px] w-[44px] animate-pulse rounded-full bg-[#25282d]"}
+                            className={
+                                "h-[24px] w-[44px] animate-pulse rounded-full bg-nb-gray-920"
+                            }
                         />
                     </div>
                 </div>
diff --git a/client/ui/frontend/src/components/switches/SwitchItem.tsx b/client/ui/frontend/src/components/switches/SwitchItem.tsx
index e23c73fe3..6b598ee8f 100644
--- a/client/ui/frontend/src/components/switches/SwitchItem.tsx
+++ b/client/ui/frontend/src/components/switches/SwitchItem.tsx
@@ -20,7 +20,7 @@ export const SwitchItem = ({ value, children, className }: Props) => {
             className={cn(
                 "relative inline-flex items-center justify-center gap-1 rounded-md px-3.5 py-2 text-xs font-semibold",
                 "cursor-default outline-none",
-                "focus-visible:ring-2 focus-visible:ring-white/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940",
+                "focus-visible:ring-2 focus-visible:ring-nb-gray-50/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940",
                 active
                     ? "text-nb-gray-100"
                     : "text-nb-gray-400 hover:text-nb-gray-200 active:text-nb-gray-100",
@@ -30,7 +30,9 @@ export const SwitchItem = ({ value, children, className }: Props) => {
             {active && (
                 <motion.span
                     layoutId={layoutId}
-                    className={"absolute inset-0 rounded-md bg-nb-gray-700"}
+                    className={
+                        "absolute inset-0 rounded-md bg-white shadow-sm dark:bg-nb-gray-700 dark:shadow-none"
+                    }
                     transition={{ type: "spring", stiffness: 500, damping: 35 }}
                 />
             )}
diff --git a/client/ui/frontend/src/components/switches/SwitchItemGroup.tsx b/client/ui/frontend/src/components/switches/SwitchItemGroup.tsx
index b4361d530..e63d245b9 100644
--- a/client/ui/frontend/src/components/switches/SwitchItemGroup.tsx
+++ b/client/ui/frontend/src/components/switches/SwitchItemGroup.tsx
@@ -48,7 +48,7 @@ export const SwitchItemGroup = ({
                 aria-label={ariaLabel}
                 aria-labelledby={ariaLabelledBy}
                 className={cn(
-                    "flex shrink-0 overflow-hidden rounded-lg border border-nb-gray-850 bg-nb-gray-910 p-1",
+                    "flex shrink-0 overflow-hidden rounded-lg border border-nb-gray-800 bg-nb-gray-910 p-1 dark:border-nb-gray-850",
                     disabled && "pointer-events-none opacity-50",
                     className,
                 )}
diff --git a/client/ui/frontend/src/components/switches/ToggleSwitch.tsx b/client/ui/frontend/src/components/switches/ToggleSwitch.tsx
index 2d9f597e6..f4fcfcf4b 100644
--- a/client/ui/frontend/src/components/switches/ToggleSwitch.tsx
+++ b/client/ui/frontend/src/components/switches/ToggleSwitch.tsx
@@ -18,8 +18,8 @@ const switchVariants = cva("", {
             default: [
                 "dark:data-[state=checked]:bg-netbird dark:data-[state=unchecked]:bg-nb-gray-700",
                 "dark:data-[state=checked]:hover:bg-netbird-500 dark:data-[state=unchecked]:hover:bg-nb-gray-600",
-                "data-[state=checked]:bg-neutral-900 data-[state=unchecked]:bg-neutral-200",
-                "data-[state=checked]:hover:bg-neutral-800 data-[state=unchecked]:hover:bg-neutral-300",
+                "data-[state=checked]:bg-netbird data-[state=unchecked]:bg-nb-gray-700",
+                "data-[state=checked]:hover:bg-netbird-500 data-[state=unchecked]:hover:bg-nb-gray-600/60",
             ],
             "red-green": [
                 "dark:data-[state=checked]:bg-red-600 dark:data-[state=unchecked]:bg-nb-gray-700",
@@ -52,7 +52,7 @@ const ToggleSwitch = React.forwardRef<
         disabled={disabled}
         tabIndex={disabled ? -1 : 0}
         className={cn(
-            "wails-no-draggable peer inline-flex shrink-0 cursor-default items-center rounded-full border-2 border-transparent transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-white/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940 disabled:cursor-not-allowed disabled:opacity-50",
+            "wails-no-draggable peer inline-flex shrink-0 cursor-default items-center rounded-full border-2 border-transparent transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-nb-gray-50/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940 disabled:cursor-not-allowed disabled:opacity-50",
             className,
             switchVariants({ size, variant }),
         )}
diff --git a/client/ui/frontend/src/components/typography/HelpText.tsx b/client/ui/frontend/src/components/typography/HelpText.tsx
index 8c52ff714..70d5cf9b1 100644
--- a/client/ui/frontend/src/components/typography/HelpText.tsx
+++ b/client/ui/frontend/src/components/typography/HelpText.tsx
@@ -11,7 +11,7 @@ type Props = {
 export const HelpText = ({ children, margin = true, className, disabled = false }: Props) => (
     <span
         className={cn(
-            "block text-[.81rem] font-light tracking-wide transition-all duration-300 dark:text-nb-gray-300",
+            "block text-[.81rem] font-light tracking-wide text-nb-gray-300 transition-all duration-300",
             margin && "mb-2",
             disabled && "pointer-events-none opacity-30",
             className,
diff --git a/client/ui/frontend/src/contexts/ThemeContext.tsx b/client/ui/frontend/src/contexts/ThemeContext.tsx
new file mode 100644
index 000000000..9aabaa379
--- /dev/null
+++ b/client/ui/frontend/src/contexts/ThemeContext.tsx
@@ -0,0 +1,129 @@
+import {
+    createContext,
+    useCallback,
+    useContext,
+    useEffect,
+    useMemo,
+    useRef,
+    useState,
+    type ReactNode,
+} from "react";
+import { Events } from "@wailsio/runtime";
+import { Preferences, Theme } from "@bindings/services";
+import { type Theme as ThemePref, type UIPreferences } from "@bindings/preferences/models.js";
+
+export type ThemePreference = "system" | "light" | "dark";
+
+const PREF_KEY = "nb-theme-pref";
+const SYSTEM_KEY = "nb-system-dark";
+
+const isPreference = (v: unknown): v is ThemePreference =>
+    v === "system" || v === "light" || v === "dark";
+
+const initialSystemDark = (): boolean => {
+    try {
+        const mirrored = localStorage.getItem(SYSTEM_KEY);
+        if (mirrored !== null) return mirrored === "true";
+    } catch {
+        /* fall through */
+    }
+    return window.matchMedia("(prefers-color-scheme: dark)").matches;
+};
+
+type ThemeContextValue = {
+    theme: ThemePreference;
+    resolvedDark: boolean;
+    setTheme: (theme: ThemePreference) => Promise<void>;
+};
+
+const ThemeContext = createContext<ThemeContextValue | null>(null);
+
+export const ThemeProvider = ({ children }: { children: ReactNode }) => {
+    const [theme, setThemeState] = useState<ThemePreference>(() => {
+        try {
+            const mirrored = localStorage.getItem(PREF_KEY);
+            if (isPreference(mirrored)) return mirrored;
+        } catch {
+            /* fall through */
+        }
+        return "system";
+    });
+    const [systemDark, setSystemDark] = useState<boolean>(initialSystemDark);
+    const themeRef = useRef(theme);
+    themeRef.current = theme;
+    // Blocks the initial Preferences.Get snapshot from overwriting newer updates.
+    const supersededRef = useRef(false);
+
+    useEffect(() => {
+        let cancelled = false;
+        Preferences.Get()
+            .then((prefs) => {
+                if (cancelled || supersededRef.current) return;
+                if (isPreference(prefs?.theme)) setThemeState(prefs.theme);
+            })
+            .catch((err: unknown) => console.warn("[ThemeContext] load preferences failed", err));
+        Theme.SystemDarkMode()
+            .then((dark) => {
+                if (!cancelled) setSystemDark(dark);
+            })
+            .catch((err: unknown) => console.warn("[ThemeContext] SystemDarkMode failed", err));
+
+        // Cross-window sync: a flip in the settings window reaches every window.
+        const offPrefs = Events.On("netbird:preferences:changed", (e: { data?: UIPreferences }) => {
+            if (isPreference(e.data?.theme)) {
+                supersededRef.current = true;
+                setThemeState(e.data.theme);
+            }
+        });
+        const offSystem = Events.On(
+            "netbird:system-theme:changed",
+            (e: { data?: { dark?: boolean } }) => {
+                if (typeof e.data?.dark === "boolean") setSystemDark(e.data.dark);
+            },
+        );
+        return () => {
+            cancelled = true;
+            offPrefs();
+            offSystem();
+        };
+    }, []);
+
+    const resolvedDark = theme === "dark" || (theme === "system" && systemDark);
+
+    // Apply the class and refresh the pre-paint mirror (index.html reads it).
+    useEffect(() => {
+        document.documentElement.classList.toggle("dark", resolvedDark);
+        try {
+            localStorage.setItem(PREF_KEY, theme);
+            localStorage.setItem(SYSTEM_KEY, String(systemDark));
+        } catch {
+            /* mirror is best-effort */
+        }
+    }, [theme, systemDark, resolvedDark]);
+
+    // Optimistic; reverts on persist failure so UI matches the stored pref.
+    const setTheme = useCallback(async (next: ThemePreference) => {
+        const prev = themeRef.current;
+        supersededRef.current = true;
+        setThemeState(next);
+        try {
+            await Preferences.SetTheme(next as ThemePref);
+        } catch (err) {
+            setThemeState(prev);
+            throw err;
+        }
+    }, []);
+
+    const value = useMemo<ThemeContextValue>(
+        () => ({ theme, resolvedDark, setTheme }),
+        [theme, resolvedDark, setTheme],
+    );
+
+    return <ThemeContext.Provider value={value}>{children}</ThemeContext.Provider>;
+};
+
+export const useTheme = () => {
+    const ctx = useContext(ThemeContext);
+    if (!ctx) throw new Error("useTheme must be used inside ThemeProvider");
+    return ctx;
+};
diff --git a/client/ui/frontend/src/globals.css b/client/ui/frontend/src/globals.css
index 84ddfdcfe..5cf2fc25d 100644
--- a/client/ui/frontend/src/globals.css
+++ b/client/ui/frontend/src/globals.css
@@ -16,6 +16,66 @@
 @tailwind components;
 @tailwind utilities;
 
+/* nb-gray channels (space-separated RGB) consumed by tailwind.config.ts.
+   :root is the inverted light ramp — high stops are surfaces (near-white),
+   low stops are text (near-black); .dark restores the original dark ramp.
+   Surfaces stay darker than content cards to preserve their separation. */
+:root {
+    --nb-gray-DEFAULT: 243 243 243;
+    --nb-gray-50: 26 26 26;
+    --nb-gray-100: 33 33 33;
+    --nb-gray-200: 50 50 50;
+    --nb-gray-250: 58 58 58;
+    --nb-gray-300: 77 77 77;
+    --nb-gray-350: 92 92 92;
+    --nb-gray-400: 108 108 108;
+    --nb-gray-500: 135 135 135;
+    --nb-gray-600: 154 154 154;
+    --nb-gray-700: 209 209 209;
+    --nb-gray-800: 226 226 226;
+    --nb-gray-850: 234 234 234;
+    --nb-gray-900: 238 238 238;
+    --nb-gray-910: 240 240 240;
+    --nb-gray-920: 243 243 243;
+    --nb-gray-925: 245 245 245;
+    --nb-gray-930: 246 246 246;
+    --nb-gray-935: 248 248 248;
+    --nb-gray-940: 250 250 250;
+    --nb-gray-950: 252 252 252;
+    --nb-gray-960: 255 255 255;
+
+    --skeleton-base: 238 238 238;
+    --skeleton-highlight: 247 247 247;
+}
+
+.dark {
+    --nb-gray-DEFAULT: 24 26 29;
+    --nb-gray-50: 244 246 247;
+    --nb-gray-100: 228 231 233;
+    --nb-gray-200: 203 210 214;
+    --nb-gray-250: 183 192 198;
+    --nb-gray-300: 163 173 181;
+    --nb-gray-350: 143 156 168;
+    --nb-gray-400: 124 137 148;
+    --nb-gray-500: 97 110 121;
+    --nb-gray-600: 83 93 103;
+    --nb-gray-700: 71 78 87;
+    --nb-gray-800: 63 68 75;
+    --nb-gray-850: 54 59 64;
+    --nb-gray-900: 46 50 56;
+    --nb-gray-910: 43 47 51;
+    --nb-gray-920: 37 40 45;
+    --nb-gray-925: 30 33 35;
+    --nb-gray-930: 37 40 44;
+    --nb-gray-935: 31 33 36;
+    --nb-gray-940: 28 30 33;
+    --nb-gray-950: 24 26 29;
+    --nb-gray-960: 22 24 27;
+
+    --skeleton-base: 37 40 45;
+    --skeleton-highlight: 51 55 62;
+}
+
 html,
 body,
 #root {
@@ -28,8 +88,9 @@ body,
  * MacBackdropTranslucent (main.go) and TitleBarHiddenInset, which on macOS
  * lets the desktop wallpaper bleed through any non-opaque pixel. A 90%
  * body alpha meant two machines with different wallpapers saw different
- * effective backgrounds. Matching Wails' BackgroundColour (#181A1D / nb-gray
- * DEFAULT) here keeps things consistent regardless of the OS backdrop.
+ * effective backgrounds. Matching the per-theme Wails BackgroundColour
+ * (services.CurrentWindowBackgroundColour, nb-gray DEFAULT in both ramps)
+ * keeps things consistent regardless of the OS backdrop.
  */
 body {
     @apply bg-nb-gray font-sans text-nb-gray-200 antialiased;
diff --git a/client/ui/frontend/src/layouts/AppRightPanel.tsx b/client/ui/frontend/src/layouts/AppRightPanel.tsx
index 8474bd71f..9656187e2 100644
--- a/client/ui/frontend/src/layouts/AppRightPanel.tsx
+++ b/client/ui/frontend/src/layouts/AppRightPanel.tsx
@@ -19,7 +19,7 @@ export const AppRightPanel = ({ children, overlay, overlayOpen = false, classNam
         <div
             className={cn(
                 "wails-no-draggable relative m-5",
-                "border border-nb-gray-920 bg-nb-gray-940",
+                "border border-nb-gray-800 bg-nb-gray-940 dark:border-nb-gray-920",
                 "flex min-h-0 min-w-0 flex-1 flex-col overflow-hidden rounded-xl rounded-br-2xl",
                 className,
             )}
diff --git a/client/ui/frontend/src/lib/formatters.ts b/client/ui/frontend/src/lib/formatters.ts
index 231967a38..a4a2f557e 100644
--- a/client/ui/frontend/src/lib/formatters.ts
+++ b/client/ui/frontend/src/lib/formatters.ts
@@ -10,8 +10,8 @@ export const formatBytes = (bytes: number, decimals: number = 2): string => {
 
 export const latencyColor = (ms: number): string => {
     if (ms <= 0) return "text-nb-gray-400";
-    if (ms < 100) return "text-green-400";
-    return "text-yellow-400";
+    if (ms < 100) return "text-green-600 dark:text-green-400";
+    return "text-yellow-600 dark:text-yellow-400";
 };
 
 export const formatRelative = (unixSeconds: number, nowMs: number = Date.now()): string | null => {
diff --git a/client/ui/frontend/src/modules/main/MainConnectionStatusSwitch.tsx b/client/ui/frontend/src/modules/main/MainConnectionStatusSwitch.tsx
index c2a648278..2f4014741 100644
--- a/client/ui/frontend/src/modules/main/MainConnectionStatusSwitch.tsx
+++ b/client/ui/frontend/src/modules/main/MainConnectionStatusSwitch.tsx
@@ -20,6 +20,7 @@ import { useFocusVisible } from "@/hooks/useFocusVisible";
 import { Check as CheckIcon, ChevronDownIcon, Copy as CopyIcon } from "lucide-react";
 import * as Popover from "@radix-ui/react-popover";
 import netbirdFullLogo from "@/assets/logos/netbird-full.svg";
+import netbirdFullLogoLight from "@/assets/logos/netbird-full-light.svg";
 
 enum ConnectionState {
     Disconnected = "disconnected",
@@ -224,10 +225,16 @@ export const MainConnectionStatusSwitch = () => {
             className={cn("flex h-full w-full flex-col items-center gap-4", "relative")}
             style={{ top: contentTop("11.7rem") }}
         >
+            <img
+                src={netbirdFullLogoLight}
+                alt={"NetBird"}
+                className={"wails-no-draggable mb-4 h-7 w-auto select-none dark:hidden"}
+                draggable={false}
+            />
             <img
                 src={netbirdFullLogo}
                 alt={"NetBird"}
-                className={"wails-no-draggable mb-4 h-7 w-auto select-none"}
+                className={"wails-no-draggable mb-4 hidden h-7 w-auto select-none dark:block"}
                 draggable={false}
             />
 
@@ -321,7 +328,7 @@ const LocalIpLine = ({ ip, ipv6, show }: { ip: string; ipv6: string; show: boole
                         className={cn(
                             "group relative inline-flex cursor-default items-center rounded-sm outline-none",
                             isFocusVisible &&
-                                "focus-visible:ring-2 focus-visible:ring-white/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940",
+                                "focus-visible:ring-2 focus-visible:ring-nb-gray-50/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940",
                             "transition-colors",
                         )}
                     >
@@ -395,7 +402,7 @@ const IpRow = ({ value }: { value: string }) => {
                 "text-nb-gray-200 hover:bg-nb-gray-900 hover:text-nb-gray-50",
                 "cursor-default outline-none transition-colors",
                 isFocusVisible &&
-                    "focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-white/60",
+                    "focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-nb-gray-50/60",
             )}
         >
             <span className={"min-w-0 truncate font-mono text-[0.75rem]"}>{value}</span>
diff --git a/client/ui/frontend/src/modules/main/MainExitNodeSwitcher.tsx b/client/ui/frontend/src/modules/main/MainExitNodeSwitcher.tsx
index fc7ce37b2..0d6579dd7 100644
--- a/client/ui/frontend/src/modules/main/MainExitNodeSwitcher.tsx
+++ b/client/ui/frontend/src/modules/main/MainExitNodeSwitcher.tsx
@@ -156,14 +156,14 @@ const ExitNodeTriggerCard = forwardRef<HTMLButtonElement, TriggerProps>(
                 disabled={disabled}
                 className={cn(
                     "flex w-full items-center gap-3 rounded-xl p-2.5 pr-5 text-left outline-none",
-                    "border border-nb-gray-920 bg-nb-gray-940",
+                    "border border-nb-gray-800 bg-nb-gray-940 dark:border-nb-gray-920",
                     "transition-colors duration-150",
                     "wails-no-draggable",
                     isFocusVisible &&
-                        "focus-visible:ring-2 focus-visible:ring-white/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940",
+                        "focus-visible:ring-2 focus-visible:ring-nb-gray-50/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940",
                     disabled
                         ? "cursor-not-allowed opacity-60"
-                        : "cursor-default hover:border-nb-gray-900 hover:bg-nb-gray-935 data-[state=open]:border-nb-gray-900 data-[state=open]:bg-nb-gray-935",
+                        : "cursor-default hover:border-nb-gray-700 hover:bg-nb-gray-935 data-[state=open]:border-nb-gray-700 data-[state=open]:bg-nb-gray-935 dark:hover:border-nb-gray-900 dark:data-[state=open]:border-nb-gray-900",
                     className,
                 )}
                 {...props}
diff --git a/client/ui/frontend/src/modules/main/MainHeader.tsx b/client/ui/frontend/src/modules/main/MainHeader.tsx
index becfde47c..d79e76cd1 100644
--- a/client/ui/frontend/src/modules/main/MainHeader.tsx
+++ b/client/ui/frontend/src/modules/main/MainHeader.tsx
@@ -74,7 +74,9 @@ export const MainHeader = () => {
                     <IconButton
                         icon={MoreVertical}
                         iconClassName={"text-nb-gray-200 wails-no-draggable"}
-                        className={"select-none"}
+                        className={
+                            "select-none hover:bg-nb-gray-800 data-[state=open]:bg-nb-gray-800 dark:hover:bg-nb-gray-900 dark:data-[state=open]:bg-nb-gray-900"
+                        }
                         aria-label={t("header.menu.open")}
                         aria-haspopup={"menu"}
                         aria-expanded={menuOpen}
diff --git a/client/ui/frontend/src/modules/main/advanced/Navigation.tsx b/client/ui/frontend/src/modules/main/advanced/Navigation.tsx
index 8d69f3580..dc8d7505b 100644
--- a/client/ui/frontend/src/modules/main/advanced/Navigation.tsx
+++ b/client/ui/frontend/src/modules/main/advanced/Navigation.tsx
@@ -108,7 +108,7 @@ export const Navigation = () => {
                             "outline-none transition-all",
                             isFirst && "rounded-tl-xl",
                             isLast && "rounded-tr-xl",
-                            "focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-white/60",
+                            "focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-nb-gray-50/60",
                             isActive ? "text-netbird" : "text-nb-gray-400 hover:text-nb-gray-300",
                             isDisabled ? "cursor-not-allowed opacity-50" : "cursor-default",
                         )}
diff --git a/client/ui/frontend/src/modules/main/advanced/networks/NetworkFilters.tsx b/client/ui/frontend/src/modules/main/advanced/networks/NetworkFilters.tsx
index ec1823f0b..0d8c9f4db 100644
--- a/client/ui/frontend/src/modules/main/advanced/networks/NetworkFilters.tsx
+++ b/client/ui/frontend/src/modules/main/advanced/networks/NetworkFilters.tsx
@@ -43,7 +43,7 @@ export const NetworkFilters = ({ value, onChange, counts, disabled }: Props) =>
                     "inline-flex h-9 items-center gap-1.5 rounded-md px-2",
                     "text-sm text-nb-gray-200",
                     "outline-none transition-colors duration-150 hover:bg-nb-gray-900 data-[state=open]:bg-nb-gray-900",
-                    "focus-visible:ring-2 focus-visible:ring-white/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940",
+                    "focus-visible:ring-2 focus-visible:ring-nb-gray-50/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940",
                     "disabled:pointer-events-none disabled:opacity-50",
                     "wails-no-draggable cursor-default",
                 )}
diff --git a/client/ui/frontend/src/modules/main/advanced/networks/Networks.tsx b/client/ui/frontend/src/modules/main/advanced/networks/Networks.tsx
index f6fe23aaf..a13993aa9 100644
--- a/client/ui/frontend/src/modules/main/advanced/networks/Networks.tsx
+++ b/client/ui/frontend/src/modules/main/advanced/networks/Networks.tsx
@@ -223,7 +223,7 @@ export const Networks = () => {
                             "text-xs font-medium text-nb-gray-100",
                             "border border-nb-gray-900 bg-nb-gray-920 hover:border-nb-gray-850 hover:bg-nb-gray-910",
                             "wails-no-draggable cursor-pointer outline-none transition-colors",
-                            "focus-visible:ring-2 focus-visible:ring-white/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940",
+                            "focus-visible:ring-2 focus-visible:ring-nb-gray-50/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940",
                         )}
                     >
                         {bulkLabel}
@@ -358,7 +358,7 @@ const NetworkRow = ({ network: n, index, onKeyDown, onToggle, setRowRef }: Netwo
                 onKeyDown={handleKey}
                 className={cn(
                     "absolute inset-0 cursor-pointer outline-none",
-                    "focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-white/60",
+                    "focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-nb-gray-50/60",
                 )}
             />
             <ResourceIconBadge type={resourceTypeOf(n)} />
@@ -396,7 +396,8 @@ const ResourceIconBadge = ({ type }: { type: ResourceType }) => {
             aria-hidden={"true"}
             className={cn(
                 "mt-[0.25rem] flex h-9 w-9 shrink-0 items-center justify-center rounded-md",
-                "border border-nb-gray-900 bg-nb-gray-920 text-nb-gray-300",
+                "border border-nb-gray-800 bg-white text-nb-gray-300 transition-colors group-hover:border-nb-gray-700",
+                "dark:border-nb-gray-900 dark:bg-nb-gray-920 dark:group-hover:border-nb-gray-900",
             )}
         >
             <Icon size={14} />
@@ -461,7 +462,7 @@ const DomainSubtitle = ({ domain, ips, onKeyDown }: DomainSubtitleProps) => {
                         keepOpenOnClick
                         contentClassName={cn(
                             "max-h-72 max-w-[18rem] overflow-auto",
-                            "rounded-lg border border-nb-gray-900 bg-nb-gray-935",
+                            "rounded-lg border border-nb-gray-800 bg-white dark:border-nb-gray-900 dark:bg-nb-gray-935",
                             "p-2 pr-4",
                         )}
                     >
diff --git a/client/ui/frontend/src/modules/main/advanced/peers/PeerDetailPanel.tsx b/client/ui/frontend/src/modules/main/advanced/peers/PeerDetailPanel.tsx
index 16500589d..ee3de6643 100644
--- a/client/ui/frontend/src/modules/main/advanced/peers/PeerDetailPanel.tsx
+++ b/client/ui/frontend/src/modules/main/advanced/peers/PeerDetailPanel.tsx
@@ -54,9 +54,9 @@ const DASH = "-";
 const dotClass = (connStatus: string): string => {
     switch (connStatus) {
         case "Connected":
-            return "bg-green-400";
+            return "bg-green-500 dark:bg-green-400";
         case "Connecting":
-            return "bg-yellow-300 animate-pulse-slow";
+            return "bg-yellow-500 animate-pulse-slow dark:bg-yellow-300";
         default:
             return "bg-nb-gray-500";
     }
@@ -195,7 +195,7 @@ export const PeerDetailPanel = ({ transition = DEFAULT_TRANSITION }: Props) => {
                                 "flex h-8 w-8 shrink-0 items-center justify-center rounded-md",
                                 "text-nb-gray-300 hover:bg-nb-gray-910 hover:text-nb-gray-100",
                                 "cursor-default outline-none transition-colors",
-                                "focus-visible:ring-2 focus-visible:ring-white/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940",
+                                "focus-visible:ring-2 focus-visible:ring-nb-gray-50/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940",
                                 "wails-no-draggable",
                             )}
                         >
@@ -235,7 +235,7 @@ export const PeerDetailPanel = ({ transition = DEFAULT_TRANSITION }: Props) => {
                                     "flex h-8 w-8 shrink-0 items-center justify-center rounded-md",
                                     "text-nb-gray-300 hover:bg-nb-gray-910 hover:text-nb-gray-100",
                                     "cursor-default outline-none transition-colors",
-                                    "focus-visible:ring-2 focus-visible:ring-white/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940",
+                                    "focus-visible:ring-2 focus-visible:ring-nb-gray-50/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940",
                                     "wails-no-draggable",
                                     "disabled:opacity-50 disabled:hover:bg-transparent",
                                 )}
@@ -468,7 +468,7 @@ const ResourcesPopover = ({ networks }: { networks: string[] }) => {
                         "border border-nb-gray-900",
                         "py-1 pl-2.5 pr-2 text-xs font-medium text-nb-gray-300",
                         "wails-no-draggable cursor-default outline-none transition-all",
-                        "focus-visible:ring-2 focus-visible:ring-white/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940",
+                        "focus-visible:ring-2 focus-visible:ring-nb-gray-50/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940",
                     )}
                 >
                     {networks.length}
@@ -530,7 +530,7 @@ const ResourceRow = ({ value }: { value: string }) => {
                 "text-nb-gray-200 hover:bg-nb-gray-900 hover:text-nb-gray-50",
                 "cursor-default outline-none transition-colors",
                 isFocusVisible &&
-                    "focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-white/60",
+                    "focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-nb-gray-50/60",
             )}
         >
             <span className={"min-w-0 truncate font-mono text-[0.75rem]"}>{value}</span>
diff --git a/client/ui/frontend/src/modules/main/advanced/peers/PeerFilters.tsx b/client/ui/frontend/src/modules/main/advanced/peers/PeerFilters.tsx
index 25d9ef822..51dd5b04e 100644
--- a/client/ui/frontend/src/modules/main/advanced/peers/PeerFilters.tsx
+++ b/client/ui/frontend/src/modules/main/advanced/peers/PeerFilters.tsx
@@ -43,7 +43,7 @@ export const PeerFilters = ({ value, onChange, counts, disabled }: Props) => {
                     "inline-flex h-9 items-center gap-1.5 rounded-md px-2",
                     "text-sm text-nb-gray-200",
                     "outline-none transition-colors duration-150 hover:bg-nb-gray-900 data-[state=open]:bg-nb-gray-900",
-                    "focus-visible:ring-2 focus-visible:ring-white/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940",
+                    "focus-visible:ring-2 focus-visible:ring-nb-gray-50/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940",
                     "disabled:pointer-events-none disabled:opacity-50",
                     "wails-no-draggable cursor-default",
                 )}
diff --git a/client/ui/frontend/src/modules/main/advanced/peers/Peers.tsx b/client/ui/frontend/src/modules/main/advanced/peers/Peers.tsx
index d61221758..f3cb0f139 100644
--- a/client/ui/frontend/src/modules/main/advanced/peers/Peers.tsx
+++ b/client/ui/frontend/src/modules/main/advanced/peers/Peers.tsx
@@ -22,9 +22,9 @@ const isOnline = (connStatus: string) => connStatus === "Connected";
 const dotClass = (connStatus: string): string => {
     switch (connStatus) {
         case "Connected":
-            return "bg-green-400";
+            return "bg-green-500 dark:bg-green-400";
         case "Connecting":
-            return "bg-yellow-300 animate-pulse-slow";
+            return "bg-yellow-500 animate-pulse-slow dark:bg-yellow-300";
         default:
             return "bg-nb-gray-500";
     }
@@ -287,7 +287,7 @@ const PeerRow = ({ peer, index, onKeyDown, onSelect, setRowRef }: PeerRowProps)
                 onKeyDown={handleKey}
                 className={cn(
                     "absolute inset-0 cursor-default outline-none",
-                    "focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-white/60",
+                    "focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-nb-gray-50/60",
                 )}
             />
             <Tooltip content={statusLabel} side={"left"}>
diff --git a/client/ui/frontend/src/modules/profiles/ProfileDropdown.tsx b/client/ui/frontend/src/modules/profiles/ProfileDropdown.tsx
index e76e300c1..81da3aa29 100644
--- a/client/ui/frontend/src/modules/profiles/ProfileDropdown.tsx
+++ b/client/ui/frontend/src/modules/profiles/ProfileDropdown.tsx
@@ -92,7 +92,7 @@ export const ProfileDropdown = ({ onManageProfiles }: ProfileDropdownProps) => {
                         listRef.current?.focus();
                     }}
                     className={cn(
-                        "wails-no-draggable z-50 min-w-64 select-none overflow-hidden rounded-lg border border-nb-gray-900 bg-nb-gray-935 p-1 text-nb-gray-200 shadow-lg",
+                        "wails-no-draggable z-50 min-w-64 select-none overflow-hidden rounded-lg border border-nb-gray-800 bg-nb-gray-950 p-1 text-nb-gray-200 shadow-lg dark:border-nb-gray-900 dark:bg-nb-gray-935",
                         "data-[state=open]:animate-in data-[state=closed]:animate-out",
                         "data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0",
                         "data-[state=closed]:zoom-out-95 data-[state=open]:zoom-in-95",
@@ -211,11 +211,11 @@ const ProfileTriggerButton = forwardRef<HTMLButtonElement, ProfileTriggerButtonP
                 aria-haspopup={"listbox"}
                 className={cn(
                     "wails-no-draggable flex h-10 cursor-default select-none items-center gap-2 rounded-lg px-3 outline-none",
-                    "text-nb-gray-200 hover:bg-nb-gray-900",
-                    "data-[state=open]:bg-nb-gray-900",
-                    "disabled:opacity-50 disabled:hover:bg-transparent",
+                    "text-nb-gray-200 hover:bg-nb-gray-800 dark:hover:bg-nb-gray-900",
+                    "data-[state=open]:bg-nb-gray-800 dark:data-[state=open]:bg-nb-gray-900",
+                    "disabled:opacity-50 disabled:hover:bg-transparent dark:disabled:hover:bg-transparent",
                     isFocusVisible &&
-                        "focus-visible:ring-2 focus-visible:ring-white/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940",
+                        "focus-visible:ring-2 focus-visible:ring-nb-gray-50/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940",
                     "wails-no-draggable transition-colors duration-150",
                     className,
                 )}
diff --git a/client/ui/frontend/src/modules/profiles/ProfilesTab.tsx b/client/ui/frontend/src/modules/profiles/ProfilesTab.tsx
index 97261ccc9..ce3994d0c 100644
--- a/client/ui/frontend/src/modules/profiles/ProfilesTab.tsx
+++ b/client/ui/frontend/src/modules/profiles/ProfilesTab.tsx
@@ -177,7 +177,7 @@ export function ProfilesTab() {
 
                 <div
                     className={cn(
-                        "overflow-hidden rounded-xl border border-nb-gray-900 bg-nb-gray-930/60",
+                        "overflow-hidden rounded-xl border border-nb-gray-800 bg-nb-gray-930/60 dark:border-nb-gray-900",
                     )}
                 >
                     <ProfilesTable
@@ -411,7 +411,7 @@ const ProfileRow = ({
                 "outline-none",
                 isFirst && "rounded-t-xl",
                 isLast && "rounded-b-xl",
-                "focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-white/60",
+                "focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-nb-gray-50/60",
             )}
         >
             <td
@@ -560,7 +560,7 @@ const RowMoreMenu = ({
                         "inline-flex h-9 w-9 cursor-default items-center justify-center rounded-md outline-none",
                         "text-nb-gray-400 hover:bg-nb-gray-900 hover:text-nb-gray-100",
                         "transition-colors duration-150",
-                        "focus-visible:ring-2 focus-visible:ring-white/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940",
+                        "focus-visible:ring-2 focus-visible:ring-nb-gray-50/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940",
                         "data-[state=open]:bg-nb-gray-900 data-[state=open]:text-nb-gray-100",
                     )}
                 >
@@ -654,7 +654,7 @@ const ActionIconButton = ({
             className={cn(
                 "inline-flex h-9 w-9 cursor-default items-center justify-center rounded-md outline-none",
                 "transition-colors duration-150",
-                "focus-visible:ring-2 focus-visible:ring-white/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940",
+                "focus-visible:ring-2 focus-visible:ring-nb-gray-50/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940",
                 variant === "danger"
                     ? "text-nb-gray-400 hover:bg-red-500/10 hover:text-red-500"
                     : "text-nb-gray-400 hover:bg-nb-gray-900 hover:text-nb-gray-100",
diff --git a/client/ui/frontend/src/modules/settings/SettingsAbout.tsx b/client/ui/frontend/src/modules/settings/SettingsAbout.tsx
index 8ba1009ba..c103d1d74 100644
--- a/client/ui/frontend/src/modules/settings/SettingsAbout.tsx
+++ b/client/ui/frontend/src/modules/settings/SettingsAbout.tsx
@@ -3,6 +3,7 @@ import { useTranslation } from "react-i18next";
 import { Browser } from "@wailsio/runtime";
 import { BookOpen, MessageSquareText, MessagesSquare } from "lucide-react";
 import netbirdFull from "@/assets/logos/netbird-full.svg";
+import netbirdFullLight from "@/assets/logos/netbird-full-light.svg";
 
 // Brand glyphs from simpleicons.org (lucide deprecated its brand icons).
 const GithubIcon = (props: SVGProps<SVGSVGElement>) => (
@@ -90,7 +91,16 @@ export function SettingsAbout() {
                 "mx-auto flex min-h-[calc(100vh-12rem)] max-w-2xl flex-col items-center justify-center gap-4"
             }
         >
-            <img src={netbirdFull} alt={t("common.netbird")} className={"h-7 w-auto"} />
+            <img
+                src={netbirdFullLight}
+                alt={t("common.netbird")}
+                className={"h-7 w-auto dark:hidden"}
+            />
+            <img
+                src={netbirdFull}
+                alt={t("common.netbird")}
+                className={"hidden h-7 w-auto dark:block"}
+            />
             <div className={"flex flex-col items-center gap-0.5 text-center"}>
                 <button
                     type={"button"}
@@ -139,7 +149,7 @@ export function SettingsAbout() {
                         tabIndex={0}
                         onClick={() => openUrl(url)}
                         className={
-                            "inline-flex items-center gap-1.5 rounded-sm decoration-[0.5px] underline-offset-4 outline-none transition hover:text-nb-gray-100 hover:underline focus-visible:ring-2 focus-visible:ring-white/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940"
+                            "inline-flex items-center gap-1.5 rounded-sm decoration-[0.5px] underline-offset-4 outline-none transition hover:text-nb-gray-100 hover:underline focus-visible:ring-2 focus-visible:ring-nb-gray-50/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940"
                         }
                     >
                         <Icon aria-hidden={"true"} className={iconClassName ?? "h-3.5 w-3.5"} />
@@ -157,7 +167,7 @@ export function SettingsAbout() {
                         tabIndex={0}
                         onClick={() => openUrl(link.url)}
                         className={
-                            "rounded-sm decoration-[0.5px] underline-offset-4 outline-none transition hover:text-nb-gray-100 hover:underline focus-visible:ring-2 focus-visible:ring-white/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940"
+                            "rounded-sm decoration-[0.5px] underline-offset-4 outline-none transition hover:text-nb-gray-100 hover:underline focus-visible:ring-2 focus-visible:ring-nb-gray-50/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940"
                         }
                     >
                         {link.label}
diff --git a/client/ui/frontend/src/modules/settings/SettingsGeneral.tsx b/client/ui/frontend/src/modules/settings/SettingsGeneral.tsx
index 71720aebe..5e0327648 100644
--- a/client/ui/frontend/src/modules/settings/SettingsGeneral.tsx
+++ b/client/ui/frontend/src/modules/settings/SettingsGeneral.tsx
@@ -10,6 +10,7 @@ import { useAutostartSetting, useSettings } from "@/contexts/SettingsContext.tsx
 import { ManagementServerSwitch } from "@/components/ManagementServerSwitch.tsx";
 import { ManagementMode, useManagementUrl } from "@/hooks/useManagementUrl.ts";
 import { LanguagePicker } from "@/components/LanguagePicker.tsx";
+import { ThemePicker } from "@/components/ThemePicker.tsx";
 import { useRestrictions } from "@/contexts/RestrictionsContext.tsx";
 import { useKeepConnectedOnQuit } from "@/hooks/useKeepConnectedOnQuit.ts";
 
@@ -36,6 +37,7 @@ export function SettingsGeneral() {
         <>
             <SectionGroup title={t("settings.general.section.general")}>
                 <LanguagePicker />
+                <ThemePicker />
                 <FancyToggleSwitch
                     value={!config.disableNotifications}
                     onChange={(v) => setField("disableNotifications", !v)}
diff --git a/client/ui/frontend/src/modules/settings/SettingsSection.tsx b/client/ui/frontend/src/modules/settings/SettingsSection.tsx
index adba65cdc..4b67fe7eb 100644
--- a/client/ui/frontend/src/modules/settings/SettingsSection.tsx
+++ b/client/ui/frontend/src/modules/settings/SettingsSection.tsx
@@ -16,7 +16,7 @@ export const SectionGroup = ({
         {...(disabled ? { inert: "" } : {})}
         className={cn(
             "mb-8 rounded-md px-1 outline-none last:mb-1",
-            "focus-visible:ring-2 focus-visible:ring-white/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940",
+            "focus-visible:ring-2 focus-visible:ring-nb-gray-50/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940",
             disabled && "pointer-events-none opacity-30",
         )}
     >
@@ -33,7 +33,7 @@ export const SettingsBottomBar = ({ children }: { children: ReactNode }) => (
         <div className={"absolute bottom-0 left-0 w-full"}>
             <div
                 className={
-                    "flex w-full justify-end gap-3 border-t border-nb-gray-920 bg-nb-gray-940 px-8 py-5"
+                    "flex w-full justify-end gap-3 border-t border-nb-gray-800 bg-nb-gray-940 px-8 py-5 dark:border-nb-gray-920"
                 }
             >
                 {children}
diff --git a/client/ui/frontend/src/modules/settings/SettingsTroubleshooting.tsx b/client/ui/frontend/src/modules/settings/SettingsTroubleshooting.tsx
index 8b1774ed6..9eac41d08 100644
--- a/client/ui/frontend/src/modules/settings/SettingsTroubleshooting.tsx
+++ b/client/ui/frontend/src/modules/settings/SettingsTroubleshooting.tsx
@@ -99,7 +99,7 @@ export function SettingsTroubleshooting() {
                                     "rounded-md border bg-white dark:bg-nb-gray-900",
                                     "border-neutral-200 dark:border-nb-gray-700",
                                     "cursor-default text-xs font-semibold text-nb-gray-100 outline-none",
-                                    "hover:border-nb-gray-600 data-[state=open]:border-nb-gray-600",
+                                    "hover:border-nb-gray-700 data-[state=open]:border-nb-gray-700 dark:hover:border-nb-gray-600 dark:data-[state=open]:border-nb-gray-600",
                                 )}
                             >
                                 {t(`settings.troubleshooting.anonymize.${anonymizeLevel}`)}
@@ -277,7 +277,10 @@ function DoneResult({
     };
     return (
         <CenteredPanel>
-            <SquareIcon icon={CircleCheckBig} className={"[&_svg]:text-green-500"} />
+            <SquareIcon
+                icon={CircleCheckBig}
+                className={"bg-white dark:bg-nb-gray-920 [&_svg]:text-green-500"}
+            />
 
             <div className={"flex max-w-sm flex-col items-center gap-2"}>
                 <DialogHeading className={"text-balance"}>
@@ -326,7 +329,9 @@ function DoneResult({
                             <button
                                 type={"button"}
                                 onClick={onRevealPath}
-                                className={"pointer-events-auto transition-all hover:text-white"}
+                                className={
+                                    "pointer-events-auto transition-all hover:text-nb-gray-50"
+                                }
                                 aria-label={t("settings.troubleshooting.done.openFileLocation")}
                             >
                                 <FolderOpen size={16} aria-hidden={"true"} />
@@ -339,7 +344,7 @@ function DoneResult({
                     <div
                         role={"alert"}
                         className={
-                            "rounded-md border border-red-500/30 bg-red-500/10 px-3 py-2 text-xs text-red-300"
+                            "rounded-md border border-red-500/30 bg-red-500/10 px-3 py-2 text-xs text-red-700 dark:text-red-300"
                         }
                     >
                         {result.uploadFailureReason
diff --git a/client/ui/frontend/tailwind.config.ts b/client/ui/frontend/tailwind.config.ts
index 93ff39eea..da41ee111 100644
--- a/client/ui/frontend/tailwind.config.ts
+++ b/client/ui/frontend/tailwind.config.ts
@@ -10,29 +10,32 @@ const config: Config = {
     },
     extend: {
       colors: {
+        // nb-gray is theme-aware: channels come from CSS variables in
+        // globals.css (:root = light ramp, .dark = original dark ramp). The
+        // rgb(var(...) / <alpha-value>) form keeps opacity modifiers working.
         "nb-gray": {
-          DEFAULT: "#181A1D",
-          50: "#f4f6f7",
-          100: "#e4e7e9",
-          200: "#cbd2d6",
-          250: "#b7c0c6",
-          300: "#a3adb5",
-          350: "#8f9ca8",
-          400: "#7c8994",
-          500: "#616e79",
-          600: "#535d67",
-          700: "#474e57",
-          800: "#3f444b",
-          850: "#363b40",
-          900: "#2e3238",
-          910: "#2b2f33",
-          920: "#25282d",
-          925: "#1e2123",
-          930: "#25282c",
-          935: "#1f2124",
-          940: "#1c1e21",
-          950: "#181a1d",
-          960: "#16181b",
+          DEFAULT: "rgb(var(--nb-gray-DEFAULT) / <alpha-value>)",
+          50: "rgb(var(--nb-gray-50) / <alpha-value>)",
+          100: "rgb(var(--nb-gray-100) / <alpha-value>)",
+          200: "rgb(var(--nb-gray-200) / <alpha-value>)",
+          250: "rgb(var(--nb-gray-250) / <alpha-value>)",
+          300: "rgb(var(--nb-gray-300) / <alpha-value>)",
+          350: "rgb(var(--nb-gray-350) / <alpha-value>)",
+          400: "rgb(var(--nb-gray-400) / <alpha-value>)",
+          500: "rgb(var(--nb-gray-500) / <alpha-value>)",
+          600: "rgb(var(--nb-gray-600) / <alpha-value>)",
+          700: "rgb(var(--nb-gray-700) / <alpha-value>)",
+          800: "rgb(var(--nb-gray-800) / <alpha-value>)",
+          850: "rgb(var(--nb-gray-850) / <alpha-value>)",
+          900: "rgb(var(--nb-gray-900) / <alpha-value>)",
+          910: "rgb(var(--nb-gray-910) / <alpha-value>)",
+          920: "rgb(var(--nb-gray-920) / <alpha-value>)",
+          925: "rgb(var(--nb-gray-925) / <alpha-value>)",
+          930: "rgb(var(--nb-gray-930) / <alpha-value>)",
+          935: "rgb(var(--nb-gray-935) / <alpha-value>)",
+          940: "rgb(var(--nb-gray-940) / <alpha-value>)",
+          950: "rgb(var(--nb-gray-950) / <alpha-value>)",
+          960: "rgb(var(--nb-gray-960) / <alpha-value>)",
         },
         gray: {
           50: "#F9FAFB",
diff --git a/client/ui/i18n/locales/de/common.json b/client/ui/i18n/locales/de/common.json
index 11e085927..c39584992 100644
--- a/client/ui/i18n/locales/de/common.json
+++ b/client/ui/i18n/locales/de/common.json
@@ -571,6 +571,21 @@
     "settings.general.language.empty": {
         "message": "Keine Sprachen gefunden."
     },
+    "settings.general.theme.label": {
+        "message": "Erscheinungsbild"
+    },
+    "settings.general.theme.help": {
+        "message": "Hell, Dunkel oder die Systemeinstellung verwenden."
+    },
+    "settings.general.theme.system": {
+        "message": "System"
+    },
+    "settings.general.theme.light": {
+        "message": "Hell"
+    },
+    "settings.general.theme.dark": {
+        "message": "Dunkel"
+    },
     "settings.general.management.label": {
         "message": "Management-Server"
     },
diff --git a/client/ui/i18n/locales/en/common.json b/client/ui/i18n/locales/en/common.json
index 36f00e4bd..e9ee26de4 100644
--- a/client/ui/i18n/locales/en/common.json
+++ b/client/ui/i18n/locales/en/common.json
@@ -759,6 +759,26 @@
         "message": "No languages match.",
         "description": "Shown when no languages match the search."
     },
+    "settings.general.theme.label": {
+        "message": "Theme",
+        "description": "Label for the appearance/theme picker."
+    },
+    "settings.general.theme.help": {
+        "message": "Choose light or dark, or follow your system appearance.",
+        "description": "Helper text for the theme picker."
+    },
+    "settings.general.theme.system": {
+        "message": "System",
+        "description": "Theme option: follow the OS appearance."
+    },
+    "settings.general.theme.light": {
+        "message": "Light",
+        "description": "Theme option: light appearance."
+    },
+    "settings.general.theme.dark": {
+        "message": "Dark",
+        "description": "Theme option: dark appearance."
+    },
     "settings.general.management.label": {
         "message": "Management Server",
         "description": "Label for the management-server selector."
diff --git a/client/ui/i18n/locales/es/common.json b/client/ui/i18n/locales/es/common.json
index 41872d7a0..245b5aa5f 100644
--- a/client/ui/i18n/locales/es/common.json
+++ b/client/ui/i18n/locales/es/common.json
@@ -571,6 +571,21 @@
     "settings.general.language.empty": {
         "message": "Ningún idioma coincide."
     },
+    "settings.general.theme.label": {
+        "message": "Tema"
+    },
+    "settings.general.theme.help": {
+        "message": "Elija el tema claro u oscuro, o siga la apariencia del sistema."
+    },
+    "settings.general.theme.system": {
+        "message": "Sistema"
+    },
+    "settings.general.theme.light": {
+        "message": "Claro"
+    },
+    "settings.general.theme.dark": {
+        "message": "Oscuro"
+    },
     "settings.general.management.label": {
         "message": "Servidor de gestión"
     },
diff --git a/client/ui/i18n/locales/fr/common.json b/client/ui/i18n/locales/fr/common.json
index 920ef8343..6da66a643 100644
--- a/client/ui/i18n/locales/fr/common.json
+++ b/client/ui/i18n/locales/fr/common.json
@@ -571,6 +571,21 @@
     "settings.general.language.empty": {
         "message": "Aucune langue ne correspond."
     },
+    "settings.general.theme.label": {
+        "message": "Thème"
+    },
+    "settings.general.theme.help": {
+        "message": "Choisissez le thème clair ou sombre, ou suivez l'apparence du système."
+    },
+    "settings.general.theme.system": {
+        "message": "Système"
+    },
+    "settings.general.theme.light": {
+        "message": "Clair"
+    },
+    "settings.general.theme.dark": {
+        "message": "Sombre"
+    },
     "settings.general.management.label": {
         "message": "Serveur de gestion"
     },
diff --git a/client/ui/i18n/locales/hu/common.json b/client/ui/i18n/locales/hu/common.json
index 82996e3d3..1b4d2fb9d 100644
--- a/client/ui/i18n/locales/hu/common.json
+++ b/client/ui/i18n/locales/hu/common.json
@@ -571,6 +571,21 @@
     "settings.general.language.empty": {
         "message": "Nincs találat."
     },
+    "settings.general.theme.label": {
+        "message": "Téma"
+    },
+    "settings.general.theme.help": {
+        "message": "Válassza a világos vagy sötét témát, vagy kövesse a rendszer beállítását."
+    },
+    "settings.general.theme.system": {
+        "message": "Rendszer"
+    },
+    "settings.general.theme.light": {
+        "message": "Világos"
+    },
+    "settings.general.theme.dark": {
+        "message": "Sötét"
+    },
     "settings.general.management.label": {
         "message": "Felügyeleti szerver"
     },
diff --git a/client/ui/i18n/locales/it/common.json b/client/ui/i18n/locales/it/common.json
index b8166aa6e..4cee0f842 100644
--- a/client/ui/i18n/locales/it/common.json
+++ b/client/ui/i18n/locales/it/common.json
@@ -571,6 +571,21 @@
     "settings.general.language.empty": {
         "message": "Nessuna lingua corrisponde."
     },
+    "settings.general.theme.label": {
+        "message": "Tema"
+    },
+    "settings.general.theme.help": {
+        "message": "Scelga il tema chiaro o scuro, oppure segua l'aspetto del sistema."
+    },
+    "settings.general.theme.system": {
+        "message": "Sistema"
+    },
+    "settings.general.theme.light": {
+        "message": "Chiaro"
+    },
+    "settings.general.theme.dark": {
+        "message": "Scuro"
+    },
     "settings.general.management.label": {
         "message": "Server di gestione"
     },
diff --git a/client/ui/i18n/locales/ja/common.json b/client/ui/i18n/locales/ja/common.json
index 6ffe05e1c..4fc81d283 100644
--- a/client/ui/i18n/locales/ja/common.json
+++ b/client/ui/i18n/locales/ja/common.json
@@ -571,6 +571,21 @@
     "settings.general.language.empty": {
         "message": "一致する言語がありません。"
     },
+    "settings.general.theme.label": {
+        "message": "テーマ"
+    },
+    "settings.general.theme.help": {
+        "message": "ライト、ダーク、またはシステムの外観に従います。"
+    },
+    "settings.general.theme.system": {
+        "message": "システム"
+    },
+    "settings.general.theme.light": {
+        "message": "ライト"
+    },
+    "settings.general.theme.dark": {
+        "message": "ダーク"
+    },
     "settings.general.management.label": {
         "message": "管理サーバー"
     },
diff --git a/client/ui/i18n/locales/pt/common.json b/client/ui/i18n/locales/pt/common.json
index 123e7a042..cb4a542d0 100644
--- a/client/ui/i18n/locales/pt/common.json
+++ b/client/ui/i18n/locales/pt/common.json
@@ -571,6 +571,21 @@
     "settings.general.language.empty": {
         "message": "Nenhum idioma corresponde."
     },
+    "settings.general.theme.label": {
+        "message": "Tema"
+    },
+    "settings.general.theme.help": {
+        "message": "Escolha claro, escuro ou siga a aparência do sistema."
+    },
+    "settings.general.theme.system": {
+        "message": "Sistema"
+    },
+    "settings.general.theme.light": {
+        "message": "Claro"
+    },
+    "settings.general.theme.dark": {
+        "message": "Escuro"
+    },
     "settings.general.management.label": {
         "message": "Servidor de gerenciamento"
     },
diff --git a/client/ui/i18n/locales/ru/common.json b/client/ui/i18n/locales/ru/common.json
index 3881a3783..61ece03b8 100644
--- a/client/ui/i18n/locales/ru/common.json
+++ b/client/ui/i18n/locales/ru/common.json
@@ -571,6 +571,21 @@
     "settings.general.language.empty": {
         "message": "Языки не найдены."
     },
+    "settings.general.theme.label": {
+        "message": "Тема"
+    },
+    "settings.general.theme.help": {
+        "message": "Выберите светлую или тёмную тему либо следуйте системной."
+    },
+    "settings.general.theme.system": {
+        "message": "Системная"
+    },
+    "settings.general.theme.light": {
+        "message": "Светлая"
+    },
+    "settings.general.theme.dark": {
+        "message": "Тёмная"
+    },
     "settings.general.management.label": {
         "message": "Сервер управления"
     },
diff --git a/client/ui/i18n/locales/uk/common.json b/client/ui/i18n/locales/uk/common.json
index 4e3f24102..f8fe71562 100644
--- a/client/ui/i18n/locales/uk/common.json
+++ b/client/ui/i18n/locales/uk/common.json
@@ -569,6 +569,21 @@
     "settings.general.language.empty": {
         "message": "Не знайдено жодної мови."
     },
+    "settings.general.theme.label": {
+        "message": "Тема"
+    },
+    "settings.general.theme.help": {
+        "message": "Виберіть світлу чи темну тему або використовуйте системні налаштування."
+    },
+    "settings.general.theme.system": {
+        "message": "Системна"
+    },
+    "settings.general.theme.light": {
+        "message": "Світла"
+    },
+    "settings.general.theme.dark": {
+        "message": "Темна"
+    },
     "settings.general.management.label": {
         "message": "Сервер керування"
     },
@@ -764,7 +779,7 @@
     "settings.troubleshooting.anonymize.help": {
         "message": "Приховує IP-адреси, домени та інші конфіденційні дані."
     },
-        "settings.troubleshooting.anonymize.info": {
+    "settings.troubleshooting.anonymize.info": {
         "message": "«Стандартний» залишає внутрішні адреси IPv4 та імена пірів читабельними для служби підтримки. «Суворий» додатково анонімізує приватні (RFC 1918), CGNAT- та link-local-адреси, імена пірів і публічні ключі WireGuard. Однакові значення замінюються тим самим псевдонімом, тож піри залишаються розрізнюваними. Використовуйте «Суворий», якщо ділитеся архівом за межами організації."
     },
     "settings.troubleshooting.anonymize.none": {
@@ -1370,7 +1385,7 @@
     "settings.ssh.privilege.oneWayInverted": {
         "message": "Ви можете увімкнути це, але щоб вимкнути знову, знадобиться {actor}:"
     },
-        "settings.ssh.privilege.authorizePending": {
+    "settings.ssh.privilege.authorizePending": {
         "message": "Очікування авторизації…"
     }
 }
diff --git a/client/ui/i18n/locales/zh-CN/common.json b/client/ui/i18n/locales/zh-CN/common.json
index b1ff3370d..126b11851 100644
--- a/client/ui/i18n/locales/zh-CN/common.json
+++ b/client/ui/i18n/locales/zh-CN/common.json
@@ -571,6 +571,21 @@
     "settings.general.language.empty": {
         "message": "没有匹配的语言。"
     },
+    "settings.general.theme.label": {
+        "message": "主题"
+    },
+    "settings.general.theme.help": {
+        "message": "选择浅色、深色或跟随系统外观。"
+    },
+    "settings.general.theme.system": {
+        "message": "跟随系统"
+    },
+    "settings.general.theme.light": {
+        "message": "浅色"
+    },
+    "settings.general.theme.dark": {
+        "message": "深色"
+    },
     "settings.general.management.label": {
         "message": "管理服务器"
     },
diff --git a/client/ui/main.go b/client/ui/main.go
index 1a866e3a5..74a87b4df 100644
--- a/client/ui/main.go
+++ b/client/ui/main.go
@@ -77,6 +77,7 @@ func init() {
 	application.RegisterEvent[authsession.Warning](services.EventSessionWarning)
 	application.RegisterEvent[updater.State](updater.EventStateChanged)
 	application.RegisterEvent[preferences.UIPreferences](preferences.EventPreferencesChanged)
+	application.RegisterEvent[services.SystemTheme](services.EventSystemThemeChanged)
 }
 
 func main() {
@@ -123,6 +124,9 @@ func main() {
 
 	bundle, prefStore, localizer := buildI18n(app)
 
+	// Before any window exists so creation-time backgrounds are already themed.
+	app.RegisterService(application.NewService(services.NewTheme(app, prefStore)))
+
 	// After bundle + prefStore: both are used to localise daemon errors.
 	settings := services.NewSettings(conn, bundle, prefStore, daemonAddr)
 	connection := services.NewConnection(conn, bundle, prefStore)
@@ -354,6 +358,7 @@ func newMainWindow(app *application.App, prefStore *preferences.Store, wm *servi
 	if prefStore.Get().ViewMode == preferences.ViewModeAdvanced {
 		initialWidth = 900
 	}
+	appearance := services.CurrentAppearance()
 	window := app.Window.NewWithOptions(application.WebviewWindowOptions{
 		Name:   "main",
 		Title:  "NetBird",
@@ -363,13 +368,13 @@ func newMainWindow(app *application.App, prefStore *preferences.Store, wm *servi
 		// drop new windows top-left unless asked.
 		InitialPosition:     application.WindowCentered,
 		Hidden:              true,
-		BackgroundColour:    services.WindowBackgroundColour,
+		BackgroundColour:    services.WindowBackgroundColour(appearance),
 		URL:                 startURL,
 		DisableResize:       true,
 		MinimiseButtonState: application.ButtonHidden,
 		MaximiseButtonState: application.ButtonHidden,
-		Mac:                 services.AppleMacOSAppearanceOptions(),
-		Windows:             services.MicrosoftWindowsAppearanceOptions(),
+		Mac:                 services.AppleMacOSAppearanceOptions(appearance),
+		Windows:             services.MicrosoftWindowsAppearanceOptions(appearance),
 		Linux: application.LinuxWindow{
 			Icon: iconWindow,
 		},
diff --git a/client/ui/preferences/store.go b/client/ui/preferences/store.go
index 3b677016f..9f3f9297e 100644
--- a/client/ui/preferences/store.go
+++ b/client/ui/preferences/store.go
@@ -49,10 +49,34 @@ func (v ViewMode) IsValid() bool {
 	return false
 }
 
+// Theme is the preferred UI appearance: follow the OS ("system") or force
+// "light"/"dark".
+type Theme string
+
+const (
+	ThemeSystem Theme = "system"
+	ThemeLight  Theme = "light"
+	ThemeDark   Theme = "dark"
+)
+
+// DefaultTheme applies when no file exists or its theme is empty/unknown.
+const DefaultTheme = ThemeSystem
+
+var ErrUnsupportedTheme = errors.New("unsupported theme")
+
+func (t Theme) IsValid() bool {
+	switch t {
+	case ThemeSystem, ThemeLight, ThemeDark:
+		return true
+	}
+	return false
+}
+
 // UIPreferences is rewritten in full on every change; there are no partial updates.
 type UIPreferences struct {
 	Language            i18n.LanguageCode `json:"language"`
 	ViewMode            ViewMode          `json:"viewMode"`
+	Theme               Theme             `json:"theme"`
 	OnboardingCompleted bool              `json:"onboardingCompleted"`
 	// AutostartInitialized records that the one-time autostart default
 	// decision has run for this OS user. It only ever transitions to true
@@ -105,7 +129,7 @@ func NewStore(validator LanguageValidator, emitter Emitter) (*Store, error) {
 		path:      path,
 		validator: validator,
 		emitter:   emitter,
-		current:   UIPreferences{ViewMode: DefaultViewMode},
+		current:   UIPreferences{ViewMode: DefaultViewMode, Theme: DefaultTheme},
 	}
 
 	if err := s.load(); err != nil {
@@ -146,6 +170,30 @@ func (s *Store) SetViewMode(mode ViewMode) error {
 	return nil
 }
 
+// SetTheme validates, persists, and broadcasts. No-op if unchanged.
+func (s *Store) SetTheme(theme Theme) error {
+	if !theme.IsValid() {
+		return fmt.Errorf("%w: %q", ErrUnsupportedTheme, theme)
+	}
+
+	s.mu.Lock()
+	if s.current.Theme == theme {
+		s.mu.Unlock()
+		return nil
+	}
+	next := s.current
+	next.Theme = theme
+	if err := s.persistLocked(next); err != nil {
+		s.mu.Unlock()
+		return fmt.Errorf("persist preferences: %w", err)
+	}
+	s.current = next
+	s.mu.Unlock()
+
+	s.broadcast(next)
+	return nil
+}
+
 // SetOnboardingCompleted persists the welcome-window dismissal. No-op if unchanged.
 func (s *Store) SetOnboardingCompleted(done bool) error {
 	s.mu.Lock()
@@ -288,6 +336,9 @@ func (s *Store) load() error {
 	if !loaded.ViewMode.IsValid() {
 		loaded.ViewMode = DefaultViewMode
 	}
+	if !loaded.Theme.IsValid() {
+		loaded.Theme = DefaultTheme
+	}
 
 	s.mu.Lock()
 	s.current = loaded
diff --git a/client/ui/services/appappearance_linux.go b/client/ui/services/appappearance_linux.go
new file mode 100644
index 000000000..0cfc46d5c
--- /dev/null
+++ b/client/ui/services/appappearance_linux.go
@@ -0,0 +1,99 @@
+//go:build linux && cgo && !android && !ios
+
+package services
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+)
+
+// setAppAppearance points GTK at the light or dark variant of the current theme
+// so the decorations match the webview. Without it a forced Light theme keeps
+// dark decorations on a dark desktop, and the reverse.
+//
+// The theme name is switched, not just gtk-application-prefer-dark-theme:
+// desktops such as Ubuntu implement dark mode as a separate theme (Yaru-dark),
+// which that flag cannot lighten. The flag is still set for themes that do
+// carry both variants under one name. Both are per-process settings, so this
+// changes only our own decorations; GTK re-reads the desktop value on a change,
+// which is why Theme.apply re-asserts. Must run on the main thread.
+//
+// GTK styling is app-wide, which is why this is separate from
+// setWindowAppearance: it must be applied even when no window exists yet, since
+// windows created later inherit it rather than carrying it in their options.
+func setAppAppearance(dark bool) {
+	target := baseGtkTheme(gtkThemeName())
+	if dark {
+		if variant, ok := darkGtkVariant(target); ok {
+			target = variant
+		}
+	}
+	// An unknown name would leave GTK with no theme at all, so fall back to
+	// changing nothing and let the prefer-dark flag do what it can.
+	if target != "" && !gtkThemeExists(target) {
+		target = ""
+	}
+	applyGtkTheme(target, dark)
+}
+
+// baseGtkTheme strips a dark-variant suffix, so "Yaru-dark" becomes "Yaru".
+func baseGtkTheme(name string) string {
+	for _, suffix := range []string{"-dark", "-Dark"} {
+		if len(name) > len(suffix) && strings.EqualFold(name[len(name)-len(suffix):], suffix) {
+			return name[:len(name)-len(suffix)]
+		}
+	}
+	return name
+}
+
+// darkGtkVariant reports the installed dark counterpart of a base theme name.
+// Themes that carry both variants under one name have none, and rely on
+// gtk-application-prefer-dark-theme instead.
+func darkGtkVariant(base string) (string, bool) {
+	if base == "" {
+		return "", false
+	}
+	for _, suffix := range []string{"-dark", "-Dark"} {
+		if candidate := base + suffix; gtkThemeExists(candidate) {
+			return candidate, true
+		}
+	}
+	return "", false
+}
+
+// gtkThemeExists reports whether a theme of that name is installed, searching
+// the same locations GTK does.
+func gtkThemeExists(name string) bool {
+	if name == "" {
+		return false
+	}
+	for _, dir := range gtkThemeDirs() {
+		if info, err := os.Stat(filepath.Join(dir, name)); err == nil && info.IsDir() {
+			return true
+		}
+	}
+	return false
+}
+
+func gtkThemeDirs() []string {
+	var dirs []string
+	if home, err := os.UserHomeDir(); err == nil {
+		dirs = append(dirs, filepath.Join(home, ".themes"))
+	}
+	if dataHome := os.Getenv("XDG_DATA_HOME"); dataHome != "" {
+		dirs = append(dirs, filepath.Join(dataHome, "themes"))
+	} else if home, err := os.UserHomeDir(); err == nil {
+		dirs = append(dirs, filepath.Join(home, ".local", "share", "themes"))
+	}
+	dataDirs := os.Getenv("XDG_DATA_DIRS")
+	if dataDirs == "" {
+		dataDirs = "/usr/local/share:/usr/share"
+	}
+	for _, dir := range strings.Split(dataDirs, ":") {
+		if dir != "" {
+			dirs = append(dirs, filepath.Join(dir, "themes"))
+		}
+	}
+	return dirs
+}
diff --git a/client/ui/services/appappearance_linux_gtk.go b/client/ui/services/appappearance_linux_gtk.go
new file mode 100644
index 000000000..2648b2808
--- /dev/null
+++ b/client/ui/services/appappearance_linux_gtk.go
@@ -0,0 +1,63 @@
+//go:build linux && cgo && !android && !ios
+
+package services
+
+/*
+// The GTK major version is the only difference between the two Linux builds, so
+// it is selected by these two directives rather than by keeping a second copy of
+// this file per version: the C below and the Go wrappers under it are identical
+// for GTK3 and GTK4, and both resolve <gtk/gtk.h> through pkg-config.
+#cgo gtk3 pkg-config: gtk+-3.0
+#cgo !gtk3 pkg-config: gtk4
+#include <stdlib.h>
+#include <gtk/gtk.h>
+
+static char *nbGetGtkThemeName(void) {
+	GtkSettings *settings = gtk_settings_get_default();
+	if (settings == NULL) {
+		return NULL;
+	}
+	char *name = NULL;
+	g_object_get(settings, "gtk-theme-name", &name, NULL);
+	return name;
+}
+
+// name may be NULL to leave the theme name untouched.
+static void nbSetGtkTheme(const char *name, int dark) {
+	GtkSettings *settings = gtk_settings_get_default();
+	if (settings == NULL) {
+		return;
+	}
+	if (name != NULL && name[0] != '\0') {
+		g_object_set(settings, "gtk-theme-name", name, NULL);
+	}
+	g_object_set(settings, "gtk-application-prefer-dark-theme", dark ? TRUE : FALSE, NULL);
+}
+
+static void nbFreeGtkString(char *s) { g_free(s); }
+*/
+import "C"
+
+import "unsafe"
+
+func gtkThemeName() string {
+	c := C.nbGetGtkThemeName()
+	if c == nil {
+		return ""
+	}
+	defer C.nbFreeGtkString(c)
+	return C.GoString(c)
+}
+
+func applyGtkTheme(name string, dark bool) {
+	var cName *C.char
+	if name != "" {
+		cName = C.CString(name)
+		defer C.free(unsafe.Pointer(cName))
+	}
+	var forced C.int
+	if dark {
+		forced = 1
+	}
+	C.nbSetGtkTheme(cName, forced)
+}
diff --git a/client/ui/services/appappearance_other.go b/client/ui/services/appappearance_other.go
new file mode 100644
index 000000000..aaad912b3
--- /dev/null
+++ b/client/ui/services/appappearance_other.go
@@ -0,0 +1,7 @@
+//go:build !(linux && cgo)
+
+package services
+
+// setAppAppearance is a no-op where the platform has no app-wide appearance to
+// set; macOS and Windows theme each window instead, via setWindowAppearance.
+func setAppAppearance(bool) {}
diff --git a/client/ui/services/preferences.go b/client/ui/services/preferences.go
index 77faa4ef6..592d52e7b 100644
--- a/client/ui/services/preferences.go
+++ b/client/ui/services/preferences.go
@@ -31,6 +31,10 @@ func (s *Preferences) SetViewMode(_ context.Context, mode preferences.ViewMode)
 	return s.store.SetViewMode(mode)
 }
 
+func (s *Preferences) SetTheme(_ context.Context, theme preferences.Theme) error {
+	return s.store.SetTheme(theme)
+}
+
 func (s *Preferences) SetOnboardingCompleted(_ context.Context, done bool) error {
 	return s.store.SetOnboardingCompleted(done)
 }
diff --git a/client/ui/services/settings.go b/client/ui/services/settings.go
index 91aac0467..7c20184bd 100644
--- a/client/ui/services/settings.go
+++ b/client/ui/services/settings.go
@@ -11,37 +11,18 @@ import (
 
 	"github.com/netbirdio/netbird/client/internal/daemonaddr"
 	"github.com/netbirdio/netbird/client/internal/ipcauth"
+	"github.com/netbirdio/netbird/client/mdm"
 	"github.com/netbirdio/netbird/client/proto"
 )
 
-type MDMFields struct {
-	ManagementURL            string `json:"managementURL"`
-	PreSharedKey             bool   `json:"preSharedKey"`
-	WireguardPort            bool   `json:"wireguardPort"`
-	RosenpassEnabled         bool   `json:"rosenpassEnabled"`
-	RosenpassPermissive      bool   `json:"rosenpassPermissive"`
-	DisableClientRoutes      bool   `json:"disableClientRoutes"`
-	DisableServerRoutes      bool   `json:"disableServerRoutes"`
-	AllowServerSSH           *bool  `json:"allowServerSSH"`
-	DisableAutoConnect       bool   `json:"disableAutoConnect"`
-	DisableAutostart         bool   `json:"disableAutostart"`
-	BlockInbound             bool   `json:"blockInbound"`
-	DisableMetricsCollection bool   `json:"disableMetricsCollection"`
-	SplitTunnelMode          bool   `json:"splitTunnelMode"`
-	SplitTunnelApps          bool   `json:"splitTunnelApps"`
-	DisableAdvancedView      bool   `json:"disableAdvancedView"`
-}
+// MDMFields is the shared per-key MDM enforcement snapshot; see mdm.Fields.
+type MDMFields = mdm.Fields
 
-type Features struct {
-	DisableProfiles       bool `json:"disableProfiles"`
-	DisableNetworks       bool `json:"disableNetworks"`
-	DisableUpdateSettings bool `json:"disableUpdateSettings"`
-}
+// Features is the shared feature-gate snapshot; see mdm.Features.
+type Features = mdm.Features
 
-type Restrictions struct {
-	MDM      MDMFields `json:"mdm"`
-	Features Features  `json:"features"`
-}
+// Restrictions is the shared UI enforcement snapshot; see mdm.Restrictions.
+type Restrictions = mdm.Restrictions
 
 // Privilege tells the frontend whether this process may perform the changes the
 // daemon restricts to root/administrator, whether it can ask the operating
@@ -383,7 +364,7 @@ func (s *Settings) GetRestrictions(ctx context.Context) (Restrictions, error) {
 		},
 	}
 	applyMDMRestrictions(&r.MDM, cfgResp)
-	r.MDM.DisableAdvancedView = featResp.GetDisableAdvancedView()
+	r.MDM.DisableAdvancedView = featResp.DisableAdvancedView
 	return r, nil
 }
 
@@ -411,9 +392,6 @@ func applyMDMRestrictions(mdm *MDMFields, cfgResp *proto.GetConfigResponse) {
 		if v.Field(i).Kind() != reflect.Bool {
 			continue
 		}
-		if t.Field(i).Name == "DisableAdvancedView" {
-			continue
-		}
 		if _, ok := set[t.Field(i).Tag.Get("json")]; ok {
 			v.Field(i).SetBool(true)
 		}
diff --git a/client/ui/services/theme.go b/client/ui/services/theme.go
new file mode 100644
index 000000000..52215e34b
--- /dev/null
+++ b/client/ui/services/theme.go
@@ -0,0 +1,194 @@
+//go:build !android && !ios && !freebsd && !js
+
+package services
+
+import (
+	"context"
+	"sync"
+	"sync/atomic"
+
+	"github.com/wailsapp/wails/v3/pkg/application"
+	"github.com/wailsapp/wails/v3/pkg/events"
+
+	"github.com/netbirdio/netbird/client/ui/preferences"
+)
+
+// EventSystemThemeChanged fires when the OS appearance flips, payload SystemTheme.
+// The frontend resolves the "system" preference against it.
+const EventSystemThemeChanged = "netbird:system-theme:changed"
+
+// SystemTheme is the EventSystemThemeChanged payload.
+type SystemTheme struct {
+	Dark bool `json:"dark"`
+}
+
+// Theme keeps native window background colours in step with the persisted
+// theme preference so no window flashes the wrong surface before the webview
+// paints. The frontend applies the matching .dark class via ThemeContext.
+type Theme struct {
+	app   *application.App
+	store *preferences.Store
+	// mu serializes apply: concurrent callers could otherwise enqueue a stale
+	// pref's native updates after a newer one's.
+	mu sync.Mutex
+	// started gates the main-thread dispatch in apply: Run installs the platform
+	// layer InvokeAsync needs, and the store subscription can fire before that.
+	started atomic.Bool
+}
+
+// NewTheme wires the store subscription and OS theme-change listener. Call
+// before any window is created so creation-time colours are already themed.
+func NewTheme(app *application.App, store *preferences.Store) *Theme {
+	t := &Theme{app: app, store: store}
+	pref := store.Get().Theme
+	setAppearance(pref, resolveDark(pref, app.Env.IsDarkMode()))
+
+	// Window creation resolves through this rather than the seed above, which
+	// is wrong until Run installs the platform layer: Env.IsDarkMode reports
+	// light before that, so a "system" launch on a dark OS would build the
+	// first window light. The ApplicationStarted apply below cannot be relied
+	// on to land first because Wails runs each listener in its own goroutine.
+	// One store read backs both fields, so the snapshot is always self-consistent.
+	setAppearanceResolver(func() Appearance {
+		p := t.store.Get().Theme
+		return Appearance{Pref: p, Dark: resolveDark(p, t.app.Env.IsDarkMode())}
+	})
+
+	ch, _ := store.Subscribe()
+	go func() {
+		var last preferences.Theme
+		for p := range ch {
+			if p.Theme == last {
+				continue
+			}
+			last = p.Theme
+			t.apply()
+		}
+	}()
+
+	// Re-apply on every OS flip, not just for ThemeSystem: Windows re-evaluates
+	// process-level theme state on WM_SETTINGCHANGE, so a forced theme has to be
+	// re-asserted or the native chrome drifts to the OS appearance. The event's
+	// own IsDarkMode is deliberately unused: Wails runs each application event
+	// handler in its own goroutine, so two rapid flips race, and apply re-reads
+	// the appearance under mu instead.
+	app.Event.OnApplicationEvent(events.Common.ThemeChanged, func(*application.ApplicationEvent) {
+		t.apply()
+	})
+
+	// Startup is split in two because Wails runs every application-event
+	// listener in its own goroutine, so a listener cannot be ordered against the
+	// one that opens the first-launch window. Hooks can: they run sequentially,
+	// in registration order, and all of them before any listener is spawned.
+	//
+	// The app-wide GTK theme goes in the hook because it is the part a window
+	// must not be created without. On Linux it draws the decorations and
+	// application.LinuxWindow carries no theme of its own, so a window built
+	// before it lands shows OS-coloured decorations until it does. It is applied
+	// synchronously for the same reason -- returning from the hook has to mean
+	// the theme is live. This relies on the listener below existing: Wails skips
+	// an event's hooks entirely when it has no listeners.
+	app.Event.RegisterApplicationEventHook(events.Common.ApplicationStarted, func(*application.ApplicationEvent) {
+		t.started.Store(true)
+		t.syncAppAppearance()
+	})
+
+	// The rest of the startup apply. Env.IsDarkMode is a stub until the platform
+	// layer is up, so re-resolve once the app has started or a "system" launch on
+	// a light OS stays seeded dark.
+	app.Event.OnApplicationEvent(events.Common.ApplicationStarted, func(*application.ApplicationEvent) {
+		t.apply()
+	})
+
+	return t
+}
+
+// syncAppAppearance applies the app-wide appearance and waits for the UI thread
+// to have done it. Use it where a window is about to be created and must not be
+// built against the OS appearance: apply dispatches its own native work
+// asynchronously, so on Linux the GTK theme behind the decorations can otherwise
+// land after the window exists.
+//
+// No-op before the app has started, where InvokeSync has no platform layer to
+// dispatch to. Reads the appearance under mu like apply, so the two cannot
+// interleave into a torn update.
+func (t *Theme) syncAppAppearance() {
+	if !t.started.Load() {
+		return
+	}
+	t.mu.Lock()
+	defer t.mu.Unlock()
+
+	pref := t.store.Get().Theme
+	dark := resolveDark(pref, t.app.Env.IsDarkMode())
+	setAppearance(pref, dark)
+	application.InvokeSync(func() { setAppAppearance(dark) })
+}
+
+// SystemDarkMode reports the OS appearance; bound so the frontend can resolve
+// the "system" preference from the same source as the native layer.
+func (t *Theme) SystemDarkMode(_ context.Context) (bool, error) {
+	return t.app.Env.IsDarkMode(), nil
+}
+
+// resolveDark maps a preference to an effective appearance against a system
+// reading the caller already took.
+func resolveDark(pref preferences.Theme, systemDark bool) bool {
+	switch pref {
+	case preferences.ThemeDark:
+		return true
+	case preferences.ThemeLight:
+		return false
+	default:
+		return systemDark
+	}
+}
+
+// apply recomputes the effective appearance, re-tints every live window
+// (including the macOS NSWindow appearance so the frame matches the webview)
+// and publishes the system appearance the frontend resolves "system" against.
+//
+// Everything runs under mu and reads the appearance here rather than taking it
+// from a caller, so a later apply always carries the fresher state and the
+// frontend event is ordered by the same lock as the native assignments. Emit
+// only appends to a FIFO mailbox, so holding mu across it cannot block.
+//
+// The OS is read exactly once per update and the resolved value is passed on to
+// the background and the native chrome, so those cannot land on either side of
+// an OS flip that happens mid-apply. The event carries the raw system reading,
+// not the resolved one, because the frontend resolves "system" itself.
+func (t *Theme) apply() {
+	t.mu.Lock()
+	defer t.mu.Unlock()
+
+	pref := t.store.Get().Theme
+	systemDark := t.app.Env.IsDarkMode()
+	dark := resolveDark(pref, systemDark)
+	setAppearance(pref, dark)
+	t.app.Event.Emit(EventSystemThemeChanged, SystemTheme{Dark: systemDark})
+
+	// Before Run there is no platform layer for InvokeAsync to dispatch to.
+	// Windows created later read the globals set above.
+	if !t.started.Load() {
+		return
+	}
+
+	colour := windowBackgroundColour(dark)
+	// Re-tint on the UI thread and resolve each native handle there. Window
+	// teardown (markAsDestroyed then impl.close) runs as UI-thread work too, so
+	// a window closed meanwhile is either gone from GetAll or yields a nil
+	// handle -- never a freed handle the OS may already have reused.
+	application.InvokeAsync(func() {
+		// App-wide first, and unconditionally: on Linux this is the GTK theme
+		// that draws the decorations, and it must be set even with no window
+		// open because later windows inherit it instead of carrying it.
+		setAppAppearance(dark)
+		for _, w := range t.app.Window.GetAll() {
+			if w == nil {
+				continue
+			}
+			w.SetBackgroundColour(colour)
+			setWindowAppearance(w.NativeWindow(), pref, dark)
+		}
+	})
+}
diff --git a/client/ui/services/windowappearance_darwin.go b/client/ui/services/windowappearance_darwin.go
new file mode 100644
index 000000000..3c0a28447
--- /dev/null
+++ b/client/ui/services/windowappearance_darwin.go
@@ -0,0 +1,53 @@
+package services
+
+/*
+#cgo CFLAGS: -x objective-c
+#cgo LDFLAGS: -framework AppKit
+
+#import <AppKit/AppKit.h>
+
+// forced < 0: follow the OS (appearance nil); 0: light; 1: dark.
+//
+// Assigns directly rather than dispatching: Theme.apply already runs this on
+// the main thread. Deferring would outlive the caller's check that the window
+// is alive, and the __bridge cast does not retain it, so the block could touch
+// a freed NSWindow.
+static void nbSetWindowAppearance(void *nsWindow, int forced) {
+	NSWindow *window = (__bridge NSWindow *)nsWindow;
+	if (forced < 0) {
+		window.appearance = nil;
+	} else {
+		NSAppearanceName name = forced == 1 ? NSAppearanceNameDarkAqua : NSAppearanceNameAqua;
+		window.appearance = [NSAppearance appearanceNamed:name];
+	}
+}
+*/
+import "C"
+
+import (
+	"unsafe"
+
+	"github.com/netbirdio/netbird/client/ui/preferences"
+)
+
+// setWindowAppearance pins the NSWindow appearance to the forced theme, or
+// hands it back to the OS for ThemeSystem. Without this, a window created
+// under one OS appearance keeps its dark/light frame after a manual theme
+// flip, leaving a mismatched border around the webview. Must run on the main
+// thread, which Theme.apply guarantees.
+//
+// The resolved appearance is unused: for ThemeSystem a nil NSAppearance lets
+// AppKit track the OS itself, which cannot drift from a snapshot we took.
+func setWindowAppearance(nsWindow unsafe.Pointer, pref preferences.Theme, _ bool) {
+	if nsWindow == nil {
+		return
+	}
+	forced := C.int(-1)
+	switch pref {
+	case preferences.ThemeLight:
+		forced = 0
+	case preferences.ThemeDark:
+		forced = 1
+	}
+	C.nbSetWindowAppearance(nsWindow, forced)
+}
diff --git a/client/ui/services/windowappearance_other.go b/client/ui/services/windowappearance_other.go
new file mode 100644
index 000000000..c2e9fbf74
--- /dev/null
+++ b/client/ui/services/windowappearance_other.go
@@ -0,0 +1,16 @@
+//go:build !darwin && !windows && !android && !ios && !freebsd && !js
+
+package services
+
+import (
+	"unsafe"
+
+	"github.com/netbirdio/netbird/client/ui/preferences"
+)
+
+// setWindowAppearance is a no-op wherever there is no per-window appearance to
+// set, which is every target this file covers. On Linux the appearance is real
+// but app-wide, so setAppAppearance owns it instead; on the remaining Unix
+// targets there is no native theming to apply at all and setAppAppearance is
+// itself a stub (appappearance_other.go).
+func setWindowAppearance(unsafe.Pointer, preferences.Theme, bool) {}
diff --git a/client/ui/services/windowappearance_windows.go b/client/ui/services/windowappearance_windows.go
new file mode 100644
index 000000000..8d5c88e47
--- /dev/null
+++ b/client/ui/services/windowappearance_windows.go
@@ -0,0 +1,54 @@
+package services
+
+import (
+	"unsafe"
+
+	"github.com/wailsapp/wails/v3/pkg/w32"
+
+	"github.com/netbirdio/netbird/client/ui/preferences"
+)
+
+// setWindowAppearance re-themes a live window's chrome; Wails only does this
+// itself on OS flips for SystemDefault windows.
+//
+// Must run on the UI thread, which Theme.apply guarantees: the uxtheme and
+// repaint calls behind w32.SetTheme belong to the window's thread, and hwnd is
+// only known live while we hold that thread. Re-dispatching here would let the
+// window be destroyed first and hand these writes a reused handle.
+//
+// dark is the appearance Theme.apply already resolved. Re-reading the OS here
+// would let the chrome land on the other side of an OS flip from the window
+// background and the webview.
+func setWindowAppearance(hwnd unsafe.Pointer, _ preferences.Theme, dark bool) {
+	if hwnd == nil || !w32.SupportsThemes() || w32.IsCurrentlyHighContrastMode() {
+		return
+	}
+
+	h := uintptr(hwnd)
+	w32.SetTheme(h, dark)
+
+	// After SetTheme, not before: its menu helper regates dark on the
+	// process-level ShouldAppsUseDarkMode and rewrites the per-window opt-in
+	// with that gated value, so forcing Dark on a light OS would lose it --
+	// and builds below 18985 need the opt-in for the pre-20H1 dark frame. The
+	// gated menu theme name is left alone on purpose: these windows carry no
+	// native menu, and popup-menu text follows the process policy, so forcing
+	// it dark gives dark text on dark.
+	if w32.AllowDarkModeForWindow != nil {
+		w32.AllowDarkModeForWindow(h, dark)
+	}
+
+	chrome := microsoftWindowsLightTheme
+	if dark {
+		chrome = microsoftWindowsDarkTheme
+	}
+	if chrome.TitleBarColour != nil {
+		w32.SetTitleBarColour(h, *chrome.TitleBarColour)
+	}
+	if chrome.TitleTextColour != nil {
+		w32.SetTitleTextColour(h, *chrome.TitleTextColour)
+	}
+	if chrome.BorderColour != nil {
+		w32.SetBorderColour(h, *chrome.BorderColour)
+	}
+}
diff --git a/client/ui/services/windowmanager.go b/client/ui/services/windowmanager.go
index d93b25821..4197f4290 100644
--- a/client/ui/services/windowmanager.go
+++ b/client/ui/services/windowmanager.go
@@ -6,6 +6,7 @@ import (
 	"net/url"
 	"strconv"
 	"sync"
+	"sync/atomic"
 	"time"
 
 	log "github.com/sirupsen/logrus"
@@ -48,39 +49,123 @@ const (
 	windowError             = "error"
 )
 
-var WindowBackgroundColour = application.NewRGB(24, 26, 29) // bg-nb-gray-950
+// Window background per effective appearance. Both match the body background
+// (bg-nb-gray DEFAULT) in globals.css so opaque native pixels and the webview
+// paint the same surface; keep the three in sync.
+var (
+	windowBackgroundDark  = application.NewRGB(24, 26, 29)    // dark nb-gray DEFAULT
+	windowBackgroundLight = application.NewRGB(243, 243, 243) // light nb-gray DEFAULT
+)
+
+// Appearance is one view of the theme state: the preference and the appearance
+// it resolves to. Take it once per window with CurrentAppearance and pass the
+// same value to every option builder -- Pref drives the macOS frame while Dark
+// drives the background and the Windows chrome, so reading them separately can
+// build a window with a new background behind the previous native frame.
+type Appearance struct {
+	Pref preferences.Theme
+	Dark bool
+}
+
+// storedAppearance is the snapshot maintained by services.Theme, published as
+// one value so the pair can never tear. It is the fallback for window creation
+// until resolveAppearance is installed.
+var storedAppearance atomic.Value // Appearance
+
+// resolveAppearance re-resolves against the live OS state. Theme installs it so
+// window creation never reads a stale seed: app.Env.IsDarkMode reports light
+// until Run installs the platform layer, and Wails runs every
+// ApplicationStarted listener in its own goroutine, so a startup window can be
+// created before Theme's listener has corrected the seed.
+var resolveAppearance atomic.Value // func() Appearance
+
+func init() {
+	storedAppearance.Store(Appearance{Pref: preferences.DefaultTheme, Dark: true})
+}
+
+func setAppearance(pref preferences.Theme, dark bool) {
+	storedAppearance.Store(Appearance{Pref: pref, Dark: dark})
+}
+
+func setAppearanceResolver(f func() Appearance) { resolveAppearance.Store(f) }
+
+// CurrentAppearance returns the snapshot every window creation must build from.
+func CurrentAppearance() Appearance {
+	if f, _ := resolveAppearance.Load().(func() Appearance); f != nil {
+		return f()
+	}
+	a, _ := storedAppearance.Load().(Appearance)
+	return a
+}
+
+// WindowBackgroundColour returns the background for a snapshot; use it for
+// every WebviewWindowOptions.BackgroundColour.
+func WindowBackgroundColour(a Appearance) application.RGBA {
+	return windowBackgroundColour(a.Dark)
+}
+
+// windowBackgroundColour maps a resolved appearance to its window background.
+func windowBackgroundColour(dark bool) application.RGBA {
+	if dark {
+		return windowBackgroundDark
+	}
+	return windowBackgroundLight
+}
 
 // WindowHeight is shared by the main and Settings windows.
 const WindowHeight = 660
 
 // Wails reads CustomTheme colours as 0x00BBGGRR (RGB byte order reversed).
-var microsoftWindowsTheme = &application.WindowTheme{
-	BorderColour:    u32ptr(0x00211E1C),
+var microsoftWindowsDarkTheme = &application.WindowTheme{
+	BorderColour:    u32ptr(0x00211E1C), // #1C1E21 nb-gray-940
 	TitleBarColour:  u32ptr(0x00211E1C),
-	TitleTextColour: u32ptr(0x00E9E7E4),
+	TitleTextColour: u32ptr(0x00E9E7E4), // #E4E7E9 nb-gray-100
 }
 
-// MicrosoftWindowsAppearanceOptions is the shared Windows chrome (Mica + dark + custom title bar).
-func MicrosoftWindowsAppearanceOptions() application.WindowsWindow {
+var microsoftWindowsLightTheme = &application.WindowTheme{
+	BorderColour:    u32ptr(0x00F3F3F3), // #F3F3F3 light nb-gray DEFAULT
+	TitleBarColour:  u32ptr(0x00F3F3F3),
+	TitleTextColour: u32ptr(0x00212121), // #212121 light nb-gray-100
+}
+
+// MicrosoftWindowsAppearanceOptions is the shared Windows chrome (Mica +
+// custom title bar), resolved at creation; setWindowAppearance re-themes live
+// windows on later changes. Never SystemDefault: Wails gives those windows a
+// SystemThemeChanged handler that re-themes chrome from the OS appearance,
+// which outlives a switch to a forced theme and fights it on the next OS flip.
+// Both CustomTheme slots hold one colour set for the same reason.
+func MicrosoftWindowsAppearanceOptions(a Appearance) application.WindowsWindow {
+	theme, chrome := application.Light, microsoftWindowsLightTheme
+	if a.Dark {
+		theme, chrome = application.Dark, microsoftWindowsDarkTheme
+	}
 	return application.WindowsWindow{
 		BackdropType: application.Mica,
-		Theme:        application.Dark,
+		Theme:        theme,
 		CustomTheme: application.ThemeSettings{
-			DarkModeActive:    microsoftWindowsTheme,
-			DarkModeInactive:  microsoftWindowsTheme,
-			LightModeActive:   microsoftWindowsTheme,
-			LightModeInactive: microsoftWindowsTheme,
+			DarkModeActive:    chrome,
+			DarkModeInactive:  chrome,
+			LightModeActive:   chrome,
+			LightModeInactive: chrome,
 		},
 	}
 }
 
 // AppleMacOSAppearanceOptions is the shared macOS chrome; FullScreenNone keeps the fixed-size layout.
-func AppleMacOSAppearanceOptions() application.MacWindow {
+func AppleMacOSAppearanceOptions(a Appearance) application.MacWindow {
+	appearance := application.DefaultAppearance
+	switch a.Pref {
+	case preferences.ThemeLight:
+		appearance = application.NSAppearanceNameAqua
+	case preferences.ThemeDark:
+		appearance = application.NSAppearanceNameDarkAqua
+	}
 	return application.MacWindow{
 		InvisibleTitleBarHeight: 38,
 		Backdrop:                application.MacBackdropNormal,
 		TitleBar:                application.MacTitleBarHiddenInset,
 		CollectionBehavior:      application.MacWindowCollectionBehaviorFullScreenNone,
+		Appearance:              appearance,
 	}
 }
 
@@ -94,6 +179,7 @@ func LinuxAppearanceOptions(icon []byte) application.LinuxWindow {
 
 // DialogWindowOptions is the baseline for every auxiliary dialog window; callers override per-dialog.
 func DialogWindowOptions(name, title, url string, linuxIcon []byte) application.WebviewWindowOptions {
+	a := CurrentAppearance()
 	return application.WebviewWindowOptions{
 		Name:                name,
 		Title:               title,
@@ -105,10 +191,10 @@ func DialogWindowOptions(name, title, url string, linuxIcon []byte) application.
 		MinimiseButtonState: application.ButtonHidden,
 		MaximiseButtonState: application.ButtonHidden,
 		CloseButtonState:    application.ButtonEnabled,
-		BackgroundColour:    WindowBackgroundColour,
+		BackgroundColour:    WindowBackgroundColour(a),
 		URL:                 url,
-		Mac:                 AppleMacOSAppearanceOptions(),
-		Windows:             MicrosoftWindowsAppearanceOptions(),
+		Mac:                 AppleMacOSAppearanceOptions(a),
+		Windows:             MicrosoftWindowsAppearanceOptions(a),
 		Linux:               LinuxAppearanceOptions(linuxIcon),
 	}
 }
@@ -180,6 +266,7 @@ func NewWindowManager(app *application.App, mainWindow *application.WebviewWindo
 }
 
 func (s *WindowManager) newSettingsWindow() *application.WebviewWindow {
+	a := CurrentAppearance()
 	w := s.app.Window.NewWithOptions(application.WebviewWindowOptions{
 		Name:                windowSettings,
 		Title:               s.title("window.title.settings"),
@@ -190,10 +277,10 @@ func (s *WindowManager) newSettingsWindow() *application.WebviewWindow {
 		MinimiseButtonState: application.ButtonHidden,
 		MaximiseButtonState: application.ButtonHidden,
 		CloseButtonState:    application.ButtonEnabled,
-		BackgroundColour:    WindowBackgroundColour,
+		BackgroundColour:    WindowBackgroundColour(a),
 		URL:                 "/#/settings",
-		Mac:                 AppleMacOSAppearanceOptions(),
-		Windows:             MicrosoftWindowsAppearanceOptions(),
+		Mac:                 AppleMacOSAppearanceOptions(a),
+		Windows:             MicrosoftWindowsAppearanceOptions(a),
 		Linux:               LinuxAppearanceOptions(s.linuxIcon),
 	})
 	w.RegisterHook(events.Common.WindowClosing, func(_ *application.WindowEvent) {
diff --git a/client/ui/tray_theme_linux.go b/client/ui/tray_theme_linux.go
index a3249e57a..f9978a7fe 100644
--- a/client/ui/tray_theme_linux.go
+++ b/client/ui/tray_theme_linux.go
@@ -17,6 +17,13 @@ import (
 	log "github.com/sirupsen/logrus"
 )
 
+// The two KDE files that decide the panel's appearance. Both live in the user
+// config dir, so one directory watch covers them (see watchKdeConfig).
+const (
+	kdeglobalsFile = "kdeglobals"
+	plasmarcFile   = "plasmarc"
+)
+
 // startTrayTheme seeds t.panelDark and repaints on colour-scheme flips. Must
 // run before the first applyIcon so the initial paint uses the right silhouette.
 func (t *Tray) startTrayTheme() {
@@ -35,50 +42,142 @@ func isKDE() bool {
 	return false
 }
 
-// kdeglobalsPath returns the user kdeglobals path. We read only this file, not
-// the full XDG_CONFIG_DIRS cascade: Plasma writes the active scheme here, and a
-// missing Complementary group falls back to the portal.
-func kdeglobalsPath() string {
+// kdeConfigPath locates one of KDE's user config files. We read only the user
+// file, not the full XDG_CONFIG_DIRS cascade: Plasma writes the active scheme
+// and style there, and anything missing falls back to the portal.
+func kdeConfigPath(name string) string {
 	if dir := os.Getenv("XDG_CONFIG_HOME"); dir != "" {
-		return filepath.Join(dir, "kdeglobals")
+		return filepath.Join(dir, name)
 	}
 	home, err := os.UserHomeDir()
 	if err != nil {
 		return ""
 	}
-	return filepath.Join(home, ".config", "kdeglobals")
+	return filepath.Join(home, ".config", name)
 }
 
-// kdePanelIsDark reports whether the KDE Plasma panel is dark by the luma of
-// its "Complementary" background (the colour Plasma paints the tray with). ok
-// is false when this isn't KDE or the colour can't be read, so the caller falls
-// through to the portal/GTK path.
+func kdeglobalsPath() string { return kdeConfigPath(kdeglobalsFile) }
+func plasmarcPath() string   { return kdeConfigPath(plasmarcFile) }
+
+// kdePanelIsDark reports whether the KDE Plasma panel the tray icon sits on is
+// dark. ok is false when this isn't KDE or neither source was conclusive, so the
+// caller falls through to the portal/GTK path.
 func kdePanelIsDark() (dark, ok bool) {
 	if !isKDE() {
 		return false, false
 	}
-	path := kdeglobalsPath()
-	if path == "" {
-		return false, false
+	// A pinned Plasma style paints the panel itself, so it outranks the
+	// application colour scheme: a style with dark colours under a Light scheme
+	// is still a dark panel and still needs the white silhouette.
+	if dark, ok := plasmaStyleIsDark(); ok {
+		return dark, true
 	}
-	rgb, ok := readKdeComplementaryBackground(path)
+	// The default style follows the colour scheme, so decide by the luma of the
+	// window background Plasma derives the panel from. Deliberately not
+	// Complementary: that group is dark under Breeze *and* BreezeLight
+	// (42,46,50 measured on Plasma 6.7.4), so reading it kept the white icon on
+	// a light panel, where it is all but invisible.
+	rgb, ok := readKdeColour(kdeglobalsPath(), "[Colors:Window]")
 	if !ok {
 		return false, false
 	}
 	return isDarkRGB(rgb[0], rgb[1], rgb[2]), true
 }
 
-// readKdeComplementaryBackground parses kdeglobals for
-// [Colors:Complementary] BackgroundNormal and returns its R,G,B (0-255).
-func readKdeComplementaryBackground(path string) (rgb [3]uint8, ok bool) {
+// plasmaStyleIsDark reports the appearance the pinned Plasma style paints the
+// panel with, decided by the style's own colours rather than by its name. A
+// style that ships a colours file overrides the colour scheme for the shell, and
+// nothing requires the name to admit it: breeze-dark happens to, but a style
+// named neutrally can carry dark colours just as well (measured on Plasma 6.7.4:
+// panel luma 38 while kdeglobals and the portal both reported light).
+//
+// ok is false when no style is pinned, when the pinned style ships no colours --
+// the "default" style, which is exactly the case that follows the colour scheme
+// -- and when its colours cannot be read; all three fall through to kdeglobals.
+func plasmaStyleIsDark() (dark, ok bool) {
+	name, found := readIniValue(plasmarcPath(), "[Theme]", "name")
+	if !found || name == "" {
+		return false, false
+	}
+	if !isBareStyleName(name) {
+		log.Debugf("tray theme: ignoring plasma style name %q, not a bare directory name", name)
+		return false, false
+	}
+	for _, dir := range plasmaStyleDirs(name) {
+		rgb, found := readKdeColour(filepath.Join(dir, "colors"), "[Colors:Window]")
+		if !found {
+			continue
+		}
+		return isDarkRGB(rgb[0], rgb[1], rgb[2]), true
+	}
+	return false, false
+}
+
+// isBareStyleName reports whether name is safe to index a directory with. The
+// name comes from a config file and is joined into a path, so it has to be a
+// single ordinary element: "../" in it would point the read anywhere, and ".",
+// ".." and "/" all survive filepath.Base(filepath.Clean(name)) unchanged, so
+// they need rejecting by name -- ".." alone resolves a level above desktoptheme.
+func isBareStyleName(name string) bool {
+	if name == "" || name == "." || name == ".." || filepath.IsAbs(name) {
+		return false
+	}
+	return name == filepath.Base(filepath.Clean(name))
+}
+
+// plasmaStyleDirs lists where a Plasma style of that name may live, in the order
+// Plasma itself resolves them: the user data dir first, so a local style shadows
+// a system one of the same name.
+func plasmaStyleDirs(name string) []string {
+	var dirs []string
+	for _, base := range xdgDataDirs() {
+		dirs = append(dirs, filepath.Join(base, "plasma", "desktoptheme", name))
+	}
+	return dirs
+}
+
+// xdgDataDirs returns XDG_DATA_HOME (or its default) followed by XDG_DATA_DIRS.
+func xdgDataDirs() []string {
+	var dirs []string
+	if home := os.Getenv("XDG_DATA_HOME"); home != "" {
+		dirs = append(dirs, home)
+	} else if h, err := os.UserHomeDir(); err == nil {
+		dirs = append(dirs, filepath.Join(h, ".local", "share"))
+	}
+	system := os.Getenv("XDG_DATA_DIRS")
+	if system == "" {
+		system = "/usr/local/share:/usr/share"
+	}
+	for _, dir := range strings.Split(system, ":") {
+		if dir != "" {
+			dirs = append(dirs, dir)
+		}
+	}
+	return dirs
+}
+
+// readKdeColour reads group's BackgroundNormal as an R,G,B triple.
+func readKdeColour(path, group string) (rgb [3]uint8, ok bool) {
+	val, found := readIniValue(path, group, "BackgroundNormal")
+	if !found {
+		return rgb, false
+	}
+	return parseRGB(val)
+}
+
+// readIniValue returns key's value inside group from a KDE-style INI file.
+// group carries its own brackets, e.g. "[Colors:Window]".
+func readIniValue(path, group, key string) (value string, ok bool) {
+	if path == "" {
+		return "", false
+	}
 	f, err := os.Open(path)
 	if err != nil {
-		log.Debugf("tray theme: kdeglobals open failed, using portal: %v", err)
-		return rgb, false
+		log.Debugf("tray theme: %s open failed, using portal: %v", filepath.Base(path), err)
+		return "", false
 	}
 	defer func() { _ = f.Close() }()
 
-	const group = "[Colors:Complementary]"
 	inGroup := false
 	scanner := bufio.NewScanner(f)
 	for scanner.Scan() {
@@ -90,13 +189,13 @@ func readKdeComplementaryBackground(path string) (rgb [3]uint8, ok bool) {
 		if !inGroup {
 			continue
 		}
-		key, val, found := strings.Cut(line, "=")
-		if !found || strings.TrimSpace(key) != "BackgroundNormal" {
+		k, v, found := strings.Cut(line, "=")
+		if !found || strings.TrimSpace(k) != key {
 			continue
 		}
-		return parseRGB(strings.TrimSpace(val))
+		return strings.TrimSpace(v), true
 	}
-	return rgb, false
+	return "", false
 }
 
 // parseRGB parses KDE's "r,g,b" colour triple into bytes.
diff --git a/client/ui/tray_theme_linux_test.go b/client/ui/tray_theme_linux_test.go
index f14f08d7f..e3476055d 100644
--- a/client/ui/tray_theme_linux_test.go
+++ b/client/ui/tray_theme_linux_test.go
@@ -8,49 +8,346 @@ import (
 	"testing"
 )
 
-func TestReadKdeComplementaryBackground(t *testing.T) {
-	// Mirrors the KDE test VM's kdeglobals: Window light, Complementary dark.
-	// The tray sits on the panel, which Plasma paints from Complementary, so
-	// the panel is dark even though the global color-scheme is Light.
-	content := `[Colors:Window]
-BackgroundNormal=239,240,241
-
-[Colors:Complementary]
+// Values measured on Plasma 6.7.4 (Fedora 44) under each Breeze scheme. The
+// Complementary group is dark under both, which is why it can't decide the
+// panel; Window tracks it.
+const (
+	kdeglobalsLight = `[Colors:Complementary]
 BackgroundAlternate=27,30,32
 BackgroundNormal=42,46,50
 
+[Colors:Window]
+BackgroundNormal=239,240,241
+
 [General]
 ColorSchemeHash=0be804dba87e3512aeb4be3d78ed981f59f0f2f4
 `
-	path := filepath.Join(t.TempDir(), "kdeglobals")
-	if err := os.WriteFile(path, []byte(content), 0o600); err != nil {
+	kdeglobalsDark = `[Colors:Complementary]
+BackgroundNormal=32,35,38
+
+[Colors:Window]
+BackgroundNormal=32,35,38
+
+[General]
+ColorScheme=BreezeDark
+`
+)
+
+// plasmaStyle installs a Plasma style of that name under XDG_DATA_HOME. An
+// empty colours body installs the style without a colours file, which is what
+// the stock "default" style looks like.
+func plasmaStyle(t *testing.T, name, colours string) string {
+	t.Helper()
+	data := t.TempDir()
+	dir := filepath.Join(data, "plasma", "desktoptheme", name)
+	if err := os.MkdirAll(dir, 0o700); err != nil {
 		t.Fatal(err)
 	}
+	if colours != "" {
+		if err := os.WriteFile(filepath.Join(dir, "colors"), []byte(colours), 0o600); err != nil {
+			t.Fatal(err)
+		}
+	}
+	t.Setenv("XDG_DATA_HOME", data)
+	// Keep the system dirs out of it so an installed breeze-dark cannot answer.
+	t.Setenv("XDG_DATA_DIRS", filepath.Join(data, "empty"))
+	return data
+}
 
-	rgb, ok := readKdeComplementaryBackground(path)
-	if !ok {
-		t.Fatal("expected to find Complementary BackgroundNormal")
+// kdeConfig points the KDE readers at a temp dir holding the given files, and
+// makes isKDE report KDE. An empty body skips the file.
+func kdeConfig(t *testing.T, kdeglobals, plasmarc string) {
+	t.Helper()
+	dir := t.TempDir()
+	for name, body := range map[string]string{kdeglobalsFile: kdeglobals, plasmarcFile: plasmarc} {
+		if body == "" {
+			continue
+		}
+		if err := os.WriteFile(filepath.Join(dir, name), []byte(body), 0o600); err != nil {
+			t.Fatal(err)
+		}
 	}
-	if rgb != [3]uint8{42, 46, 50} {
-		t.Fatalf("rgb = %v, want [42 46 50]", rgb)
-	}
-	if !isDarkRGB(rgb[0], rgb[1], rgb[2]) {
-		t.Fatal("panel colour 42,46,50 should be dark")
-	}
-	// The Window background (what color-scheme reflects) is light — the bug
-	// this fix addresses is picking the icon from that instead of the panel.
-	if isDarkRGB(239, 240, 241) {
-		t.Fatal("window colour 239,240,241 should be light")
+	t.Setenv("XDG_CONFIG_HOME", dir)
+	t.Setenv("XDG_CURRENT_DESKTOP", "KDE")
+	// Point the Plasma style lookup at empty dirs so a style installed on the
+	// host cannot answer for a test that did not install one itself. Tests that
+	// want a style call plasmaStyle, which overrides these.
+	t.Setenv("XDG_DATA_HOME", filepath.Join(dir, "empty-data-home"))
+	t.Setenv("XDG_DATA_DIRS", filepath.Join(dir, "empty-data-dirs"))
+}
+
+// The reported bug: a Light global scheme left the panel reported dark, so the
+// tray kept the white silhouette on a light panel.
+func TestKdePanelIsDarkFollowsColourScheme(t *testing.T) {
+	for _, tc := range []struct {
+		name       string
+		kdeglobals string
+		wantDark   bool
+	}{
+		{"light scheme", kdeglobalsLight, false},
+		{"dark scheme", kdeglobalsDark, true},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			kdeConfig(t, tc.kdeglobals, "")
+			dark, ok := kdePanelIsDark()
+			if !ok {
+				t.Fatal("expected a conclusive answer from kdeglobals")
+			}
+			if dark != tc.wantDark {
+				t.Fatalf("dark = %v, want %v", dark, tc.wantDark)
+			}
+		})
 	}
 }
 
-func TestReadKdeComplementaryBackgroundMissingGroup(t *testing.T) {
-	path := filepath.Join(t.TempDir(), "kdeglobals")
-	if err := os.WriteFile(path, []byte("[Colors:Window]\nBackgroundNormal=1,2,3\n"), 0o600); err != nil {
+// A pinned Plasma style paints the panel regardless of the colour scheme, so it
+// has to outrank it in both directions. The styles are installed into the test's
+// own XDG_DATA_HOME: reading whatever the host happens to ship would make the
+// result depend on the machine.
+func TestKdePanelIsDarkPinnedStyleOutranksScheme(t *testing.T) {
+	for _, tc := range []struct {
+		name         string
+		kdeglobals   string
+		style        string
+		styleColours string
+		wantDark     bool
+	}{
+		{"dark style, light scheme", kdeglobalsLight, "breeze-dark", kdeglobalsDark, true},
+		{"light style, dark scheme", kdeglobalsDark, "breeze-light", kdeglobalsLight, false},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			kdeConfig(t, tc.kdeglobals, "[Theme]\nname="+tc.style+"\n")
+			plasmaStyle(t, tc.style, tc.styleColours)
+			dark, ok := kdePanelIsDark()
+			if !ok {
+				t.Fatal("expected a conclusive answer from the pinned style")
+			}
+			if dark != tc.wantDark {
+				t.Fatalf("dark = %v, want %v", dark, tc.wantDark)
+			}
+		})
+	}
+}
+
+// "default" fixes nothing, so the colour scheme still decides.
+func TestKdePanelIsDarkDefaultStyleDefersToScheme(t *testing.T) {
+	kdeConfig(t, kdeglobalsLight, "[Theme]\nname=default\n")
+	dark, ok := kdePanelIsDark()
+	if !ok {
+		t.Fatal("expected the colour scheme to answer")
+	}
+	if dark {
+		t.Fatal("default style on a Light scheme is a light panel")
+	}
+}
+
+// No colours and no style: stay inconclusive so readDarkMode uses the portal
+// rather than guessing.
+func TestKdePanelIsDarkInconclusive(t *testing.T) {
+	t.Run("no window group", func(t *testing.T) {
+		kdeConfig(t, "[Colors:Complementary]\nBackgroundNormal=42,46,50\n", "")
+		if _, ok := kdePanelIsDark(); ok {
+			t.Fatal("expected not-ok without a Window group")
+		}
+	})
+	t.Run("no kde files", func(t *testing.T) {
+		kdeConfig(t, "", "")
+		if _, ok := kdePanelIsDark(); ok {
+			t.Fatal("expected not-ok with no kdeglobals at all")
+		}
+	})
+	t.Run("not kde", func(t *testing.T) {
+		kdeConfig(t, kdeglobalsDark, "")
+		t.Setenv("XDG_CURRENT_DESKTOP", "ubuntu:GNOME")
+		if _, ok := kdePanelIsDark(); ok {
+			t.Fatal("expected not-ok off KDE")
+		}
+	})
+}
+
+// The panel follows the pinned style's own colours, not its name. Reproduces
+// the measured case: a neutrally named style shipping dark colours while
+// kdeglobals reports light.
+func TestPlasmaStyleIsDarkUsesStyleColours(t *testing.T) {
+	for _, tc := range []struct {
+		name     string
+		style    string
+		colours  string
+		wantDark bool
+	}{
+		{"neutral name, dark colours", "nbtestneutral", kdeglobalsDark, true},
+		{"neutral name, light colours", "nbtestneutral", kdeglobalsLight, false},
+		{"name says dark, colours are light", "midnight-dark", kdeglobalsLight, false},
+		{"name says light, colours are dark", "daylight", kdeglobalsDark, true},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			kdeConfig(t, kdeglobalsLight, "[Theme]\nname="+tc.style+"\n")
+			plasmaStyle(t, tc.style, tc.colours)
+			dark, ok := plasmaStyleIsDark()
+			if !ok {
+				t.Fatal("a style shipping colours should be conclusive")
+			}
+			if dark != tc.wantDark {
+				t.Fatalf("dark = %v, want %v", dark, tc.wantDark)
+			}
+		})
+	}
+}
+
+// End to end through kdePanelIsDark: the style's colours must beat kdeglobals.
+func TestKdePanelIsDarkStyleColoursBeatColourScheme(t *testing.T) {
+	kdeConfig(t, kdeglobalsLight, "[Theme]\nname=nbtestneutral\n")
+	plasmaStyle(t, "nbtestneutral", kdeglobalsDark)
+	dark, ok := kdePanelIsDark()
+	if !ok {
+		t.Fatal("expected a conclusive answer")
+	}
+	if !dark {
+		t.Fatal("a dark-coloured style on a Light scheme is a dark panel")
+	}
+}
+
+// A style with no colours file is the "default" case: it follows the scheme.
+func TestPlasmaStyleIsDarkNoColoursFile(t *testing.T) {
+	kdeConfig(t, kdeglobalsLight, "[Theme]\nname=default\n")
+	plasmaStyle(t, "default", "")
+	if _, ok := plasmaStyleIsDark(); ok {
+		t.Fatal("a style without colours must defer to the colour scheme")
+	}
+	// and the whole resolution then lands on the light scheme
+	dark, ok := kdePanelIsDark()
+	if !ok || dark {
+		t.Fatalf("kdePanelIsDark() = (%v, %v), want (false, true)", dark, ok)
+	}
+}
+
+func TestPlasmaStyleIsDarkInconclusive(t *testing.T) {
+	t.Run("no plasmarc", func(t *testing.T) {
+		kdeConfig(t, kdeglobalsLight, "")
+		plasmaStyle(t, "unused", kdeglobalsDark)
+		if _, ok := plasmaStyleIsDark(); ok {
+			t.Fatal("expected not-ok with no plasmarc")
+		}
+	})
+	t.Run("empty style name", func(t *testing.T) {
+		kdeConfig(t, kdeglobalsLight, "[Theme]\nname=\n")
+		if _, ok := plasmaStyleIsDark(); ok {
+			t.Fatal("expected not-ok for an empty style name")
+		}
+	})
+	t.Run("style not installed", func(t *testing.T) {
+		kdeConfig(t, kdeglobalsLight, "[Theme]\nname=absent\n")
+		plasmaStyle(t, "somethingelse", kdeglobalsDark)
+		if _, ok := plasmaStyleIsDark(); ok {
+			t.Fatal("expected not-ok when the style is not installed")
+		}
+	})
+	// ... but a leading dot in an ordinary name is fine.
+	for _, good := range []string{".hidden", "..."} {
+		t.Run("accepts "+good, func(t *testing.T) {
+			kdeConfig(t, kdeglobalsLight, "[Theme]\nname="+good+"\n")
+			plasmaStyle(t, good, kdeglobalsDark)
+			dark, ok := plasmaStyleIsDark()
+			if !ok || !dark {
+				t.Fatalf("plasmaStyleIsDark() = (%v, %v) for %q, want (true, true)", dark, ok, good)
+			}
+		})
+	}
+}
+
+// A traversing name must be rejected outright, not merely fail to find a file.
+// Each case plants colours at exactly the path the unguarded lookup would read,
+// so removing the name check makes plasmaStyleIsDark answer from the planted
+// file and these fail. Without the planted file the test would pass either way.
+func TestPlasmaStyleIsDarkRejectsPlantedEscape(t *testing.T) {
+	for _, tc := range []struct {
+		name string
+		// where filepath.Join(data, "plasma", "desktoptheme", name) lands
+		escaped []string
+	}{
+		{"..", []string{"plasma"}},
+		{".", []string{"plasma", "desktoptheme"}},
+		{"/", []string{"plasma", "desktoptheme"}},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			kdeConfig(t, kdeglobalsLight, "[Theme]\nname="+tc.name+"\n")
+			data := plasmaStyle(t, "unused", kdeglobalsLight)
+
+			target := filepath.Join(append([]string{data}, tc.escaped...)...)
+			// Guard the fixture itself: if Join ever stops landing here the
+			// test would go quietly vacuous again.
+			want := filepath.Clean(filepath.Join(data, "plasma", "desktoptheme", tc.name))
+			if target != want {
+				t.Fatalf("fixture targets %q but the lookup resolves %q", target, want)
+			}
+			if err := os.WriteFile(filepath.Join(target, "colors"), []byte(kdeglobalsDark), 0o600); err != nil {
+				t.Fatal(err)
+			}
+
+			if dark, ok := plasmaStyleIsDark(); ok {
+				t.Fatalf("plasmaStyleIsDark() = (%v, true) for %q: the name must be rejected, "+
+					"not resolved against %s", dark, tc.name, target)
+			}
+		})
+	}
+}
+
+// The rejection condition on its own, so every case is checked whether or not a
+// file happens to exist at the path it would resolve to.
+func TestIsBareStyleName(t *testing.T) {
+	for _, bad := range []string{"", ".", "..", "/", "//", "/etc", "../../../../etc", "a/b", "a/", "./x", "../x"} {
+		if isBareStyleName(bad) {
+			t.Errorf("isBareStyleName(%q) = true, want false", bad)
+		}
+	}
+	for _, good := range []string{"breeze-dark", "default", ".hidden", "...", "Breeze Dark", "a.b"} {
+		if !isBareStyleName(good) {
+			t.Errorf("isBareStyleName(%q) = false, want true", good)
+		}
+	}
+}
+
+// A local style of the same name shadows the system one, as in Plasma.
+func TestPlasmaStyleDirsPreferUserData(t *testing.T) {
+	t.Setenv("XDG_DATA_HOME", "/home/someone/.local/share")
+	t.Setenv("XDG_DATA_DIRS", "/usr/local/share:/usr/share")
+	got := plasmaStyleDirs("breeze-dark")
+	want := []string{
+		"/home/someone/.local/share/plasma/desktoptheme/breeze-dark",
+		"/usr/local/share/plasma/desktoptheme/breeze-dark",
+		"/usr/share/plasma/desktoptheme/breeze-dark",
+	}
+	if len(got) != len(want) {
+		t.Fatalf("plasmaStyleDirs() = %v, want %v", got, want)
+	}
+	for i := range want {
+		if got[i] != want[i] {
+			t.Fatalf("plasmaStyleDirs()[%d] = %q, want %q", i, got[i], want[i])
+		}
+	}
+}
+
+func TestReadIniValue(t *testing.T) {
+	path := filepath.Join(t.TempDir(), kdeglobalsFile)
+	if err := os.WriteFile(path, []byte(kdeglobalsLight), 0o600); err != nil {
 		t.Fatal(err)
 	}
-	if _, ok := readKdeComplementaryBackground(path); ok {
-		t.Fatal("expected not-ok when Complementary group is absent")
+	// The same key exists in two groups, so a group-blind reader would return
+	// whichever came first.
+	if v, ok := readIniValue(path, "[Colors:Window]", "BackgroundNormal"); !ok || v != "239,240,241" {
+		t.Fatalf("Window BackgroundNormal = %q ok=%v, want \"239,240,241\" true", v, ok)
+	}
+	if v, ok := readIniValue(path, "[Colors:Complementary]", "BackgroundNormal"); !ok || v != "42,46,50" {
+		t.Fatalf("Complementary BackgroundNormal = %q ok=%v, want \"42,46,50\" true", v, ok)
+	}
+	if _, ok := readIniValue(path, "[Colors:Window]", "ColorSchemeHash"); ok {
+		t.Fatal("a key from another group should not be found")
+	}
+	if _, ok := readIniValue(filepath.Join(t.TempDir(), "absent"), "[Theme]", "name"); ok {
+		t.Fatal("a missing file should not be found")
+	}
+	if _, ok := readIniValue("", "[Theme]", "name"); ok {
+		t.Fatal("an empty path should not be found")
 	}
 }
 
@@ -77,8 +374,8 @@ func TestIsDarkRGB(t *testing.T) {
 	if isDarkRGB(255, 255, 255) {
 		t.Fatal("white is light")
 	}
-	if !isDarkRGB(42, 46, 50) {
-		t.Fatal("Breeze panel grey is dark")
+	if !isDarkRGB(32, 35, 38) {
+		t.Fatal("BreezeDark window grey is dark")
 	}
 	if isDarkRGB(239, 240, 241) {
 		t.Fatal("Breeze window grey is light")
diff --git a/client/ui/tray_theme_watcher_linux.go b/client/ui/tray_theme_watcher_linux.go
index b9bafe30b..fa175e006 100644
--- a/client/ui/tray_theme_watcher_linux.go
+++ b/client/ui/tray_theme_watcher_linux.go
@@ -3,9 +3,10 @@
 package main
 
 // Sources: the freedesktop Settings portal's SettingChanged signal, and on KDE
-// the kdeglobals file (the portal's color-scheme doesn't track the panel's
-// Complementary colour — see readDarkMode). The dark/light decision lives in
-// tray_theme_linux.go; this file owns the session-bus connection and subscriptions.
+// the kdeglobals and plasmarc files (a pinned Plasma style fixes the panel's
+// appearance without touching the portal's color-scheme — see readDarkMode).
+// The dark/light decision lives in tray_theme_linux.go; this file owns the
+// session-bus connection and subscriptions.
 
 import (
 	"path/filepath"
@@ -66,9 +67,9 @@ func startThemeWatcher(onChange func()) *themeWatcher {
 		// Keep the connection: the seeded darkMode value is still useful.
 	}
 
-	// The portal's signal doesn't track KDE's panel Complementary colour.
+	// The portal's signal says nothing about a pinned Plasma style.
 	if isKDE() {
-		w.watchKdeglobals()
+		w.watchKdeConfig()
 	}
 
 	log.Infof("tray theme: panel dark mode = %v", w.IsDark())
@@ -88,12 +89,11 @@ func (w *themeWatcher) IsDark() bool {
 
 // readDarkMode resolves whether the panel the tray icon sits on is dark.
 //
-// On KDE the freedesktop color-scheme is the application preference, not the
-// panel's: Plasma paints its panel from the Breeze "Complementary" group, which
-// stays dark even under a Light global scheme, so we read the panel background
-// from kdeglobals first and decide by its luma. Off KDE the color-scheme portal
-// is the source; on "no preference" (0) or when unavailable we fall back to
-// GTK_THEME (":dark" suffix ⇒ dark), then default to dark.
+// KDE goes first because a pinned Plasma style decides the panel on its own,
+// independently of the application colour scheme the portal reports; with no
+// style pinned that check defers to KDE's own colour files. Off KDE the
+// color-scheme portal is the source; on "no preference" (0) or when unavailable
+// we fall back to GTK_THEME (":dark" suffix ⇒ dark), then default to dark.
 func (w *themeWatcher) readDarkMode() bool {
 	if dark, ok := kdePanelIsDark(); ok {
 		return dark
@@ -160,8 +160,8 @@ func (w *themeWatcher) loop(sigs chan *dbus.Signal) {
 			continue
 		}
 
-		// Re-resolve via readDarkMode, not the signal value: under KDE the panel
-		// colour comes from kdeglobals, so the signal value would be wrong.
+		// Re-resolve via readDarkMode, not the signal value: under KDE a pinned
+		// Plasma style overrides it, so the signal value would be wrong.
 		w.update()
 	}
 }
@@ -179,22 +179,23 @@ func (w *themeWatcher) update() {
 	}
 }
 
-// watchKdeglobals watches the parent directory, not the file: KDE rewrites
-// kdeglobals atomically (write-temp + rename), which would drop an inotify watch
-// on the original inode. Filtering by name re-arms implicitly.
-func (w *themeWatcher) watchKdeglobals() {
+// watchKdeConfig repaints on writes to either KDE file that decides the panel
+// appearance. It watches their parent directory, not the files: KDE rewrites
+// them atomically (write-temp + rename), which would drop an inotify watch on
+// the original inode. Filtering by name re-arms implicitly.
+func (w *themeWatcher) watchKdeConfig() {
 	path := kdeglobalsPath()
 	if path == "" {
 		return
 	}
-	dir, name := filepath.Split(path)
+	dir := filepath.Dir(path)
 
 	fw, err := fsnotify.NewWatcher()
 	if err != nil {
-		log.Debugf("tray theme: kdeglobals watcher unavailable, theme is static: %v", err)
+		log.Debugf("tray theme: KDE config watcher unavailable, theme is static: %v", err)
 		return
 	}
-	if err := fw.Add(filepath.Clean(dir)); err != nil {
+	if err := fw.Add(dir); err != nil {
 		log.Debugf("tray theme: watching %s failed, theme is static: %v", dir, err)
 		_ = fw.Close()
 		return
@@ -208,10 +209,14 @@ func (w *themeWatcher) watchKdeglobals() {
 				if !ok {
 					return
 				}
-				if filepath.Base(event.Name) != name {
+				switch filepath.Base(event.Name) {
+				case kdeglobalsFile, plasmarcFile:
+				default:
 					continue
 				}
-				if event.Op&(fsnotify.Write|fsnotify.Create|fsnotify.Rename) == 0 {
+				// Remove counts: deleting plasmarc unpins the Plasma style, which
+				// hands the decision back to the colour scheme and can flip it.
+				if event.Op&(fsnotify.Write|fsnotify.Create|fsnotify.Rename|fsnotify.Remove) == 0 {
 					continue
 				}
 				w.update()
@@ -219,7 +224,7 @@ func (w *themeWatcher) watchKdeglobals() {
 				if !ok {
 					return
 				}
-				log.Debugf("tray theme: kdeglobals watch error: %v", err)
+				log.Debugf("tray theme: KDE config watch error: %v", err)
 			}
 		}
 	}()
diff --git a/combined/cmd/root.go b/combined/cmd/root.go
index 3e583ef20..917312e57 100644
--- a/combined/cmd/root.go
+++ b/combined/cmd/root.go
@@ -205,7 +205,7 @@ func createAllServers(ctx context.Context, cfg *CombinedConfig) (*serverInstance
 		metricsServer: metricsServer,
 	}
 
-	_, tlsSupport, err := handleTLSConfig(cfg)
+	tlsConfig, tlsSupport, err := handleTLSConfig(cfg)
 	if err != nil {
 		return nil, fmt.Errorf("failed to setup TLS config: %w", err)
 	}
@@ -214,7 +214,7 @@ func createAllServers(ctx context.Context, cfg *CombinedConfig) (*serverInstance
 		return nil, err
 	}
 
-	if err := servers.createManagementServer(ctx, cfg); err != nil {
+	if err := servers.createManagementServer(ctx, cfg, tlsConfig); err != nil {
 		return nil, err
 	}
 
@@ -264,7 +264,7 @@ func (s *serverInstances) createRelayServer(cfg *CombinedConfig, tlsSupport bool
 	return nil
 }
 
-func (s *serverInstances) createManagementServer(ctx context.Context, cfg *CombinedConfig) error {
+func (s *serverInstances) createManagementServer(ctx context.Context, cfg *CombinedConfig, tlsConfig *tls.Config) error {
 	if !cfg.Management.Enabled {
 		return nil
 	}
@@ -297,7 +297,7 @@ func (s *serverInstances) createManagementServer(ctx context.Context, cfg *Combi
 
 	LogConfigInfo(mgmtConfig)
 
-	s.mgmtSrv, err = createManagementServer(cfg, mgmtConfig)
+	s.mgmtSrv, err = createManagementServer(cfg, mgmtConfig, tlsConfig)
 	if err != nil {
 		cleanupSTUNListeners(s.stunListeners)
 		return fmt.Errorf("failed to create management server: %w", err)
@@ -513,7 +513,7 @@ func handleTLSConfig(cfg *CombinedConfig) (*tls.Config, bool, error) {
 	return nil, false, nil
 }
 
-func createManagementServer(cfg *CombinedConfig, mgmtConfig *nbconfig.Config) (mgmtServer.Server, error) {
+func createManagementServer(cfg *CombinedConfig, mgmtConfig *nbconfig.Config, tlsConfig *tls.Config) (mgmtServer.Server, error) {
 	mgmt := cfg.Management
 
 	// Extract port from listen address
@@ -542,6 +542,7 @@ func createManagementServer(cfg *CombinedConfig, mgmtConfig *nbconfig.Config) (m
 			AutoResolveDomains:      true,
 			MgmtPort:                mgmtPort,
 			MgmtMetricsPort:         cfg.Server.MetricsPort,
+			TLSConfig:               tlsConfig,
 			DisableMetrics:          mgmt.DisableAnonymousMetrics,
 			DisableGeoliteUpdate:    mgmt.DisableGeoliteUpdate,
 			// Always enable user deletion from IDP in combined server (embedded IdP is always enabled)
diff --git a/docs/custom-domain-validation.md b/docs/custom-domain-validation.md
new file mode 100644
index 000000000..a70388e4d
--- /dev/null
+++ b/docs/custom-domain-validation.md
@@ -0,0 +1,28 @@
+A new custom domain name is converted to lowercase ASCII (punycode), with a
+trailing dot removed, before availability and DNS validation checks. Invalid
+names and wildcard registrations are rejected before storage.
+
+A custom domain registration must complete validation within 48 hours of
+creation. Retrying validation does not extend this window. Once validation
+succeeds, the registration is exempt from this expiration policy.
+
+Management removes expired, unvalidated registrations at startup and every
+60 minutes. While management is running, removal normally occurs between
+48 and 49 hours after registration. Validation is refused after the 48-hour
+deadline even if cleanup has not yet removed the registration.
+
+Removal releases the name for a new registration. The new registration must
+complete its own validation. Its account does not inherit validation or
+services from the expired registration.
+
+The original account receives a system activity event named
+`CustomDomainValidationExpired`, displayed as "Unvalidated domain registration
+expired". The event includes the domain name, original registration ID, and
+validation deadline.
+
+On upgrade, existing unvalidated registrations receive a 48-hour validation
+window. Restarting management does not extend a previously assigned deadline.
+
+Registrations with existing services, including services using subdomains, are
+retained for operator review. Management logs their account and domain IDs so
+an operator can identify and resolve those dependencies before cleanup.
diff --git a/encryption/message.go b/encryption/message.go
index 6e4cd7391..2bf2c59dc 100644
--- a/encryption/message.go
+++ b/encryption/message.go
@@ -6,6 +6,16 @@ import (
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 )
 
+type Encrypter interface {
+	EncryptMessage(remotePubKey wgtypes.Key, ourPrivateKey wgtypes.Key, message pb.Message) ([]byte, error)
+}
+
+type DefaultEncrypter struct{}
+
+func (e DefaultEncrypter) EncryptMessage(remotePubKey wgtypes.Key, ourPrivateKey wgtypes.Key, message pb.Message) ([]byte, error) {
+	return EncryptMessage(remotePubKey, ourPrivateKey, message)
+}
+
 // EncryptMessage encrypts a body of the given protobuf Message
 func EncryptMessage(remotePubKey wgtypes.Key, ourPrivateKey wgtypes.Key, message pb.Message) ([]byte, error) {
 	byteResp, err := pb.Marshal(message)
diff --git a/go.mod b/go.mod
index a2fe1e55b..8987803c1 100644
--- a/go.mod
+++ b/go.mod
@@ -343,6 +343,6 @@ replace github.com/dexidp/dex/api/v2 => github.com/netbirdio/dex/api/v2 v2.0.0-2
 
 replace github.com/mailru/easyjson => github.com/netbirdio/easyjson v0.9.0
 
-replace github.com/wailsapp/wails/v3 => github.com/netbirdio/wails/v3 v3.0.0-beta.3.0.20260825085513-5f07a01f7a78
+replace github.com/wailsapp/wails/v3 => github.com/netbirdio/wails/v3 v3.0.0-beta.3.0.20260902163841-4a71f7b1d9e1
 
 tool go.uber.org/mock/mockgen
diff --git a/go.sum b/go.sum
index 3e0b4f5dc..495b62eac 100644
--- a/go.sum
+++ b/go.sum
@@ -490,8 +490,8 @@ github.com/netbirdio/service v0.0.0-20240911161631-f62744f42502 h1:3tHlFmhTdX9ax
 github.com/netbirdio/service v0.0.0-20240911161631-f62744f42502/go.mod h1:CIMRFEJVL+0DS1a3Nx06NaMn4Dz63Ng6O7dl0qH0zVM=
 github.com/netbirdio/signal-dispatcher/dispatcher v0.0.0-20250805121659-6b4ac470ca45 h1:ujgviVYmx243Ksy7NdSwrdGPSRNE3pb8kEDSpH0QuAQ=
 github.com/netbirdio/signal-dispatcher/dispatcher v0.0.0-20250805121659-6b4ac470ca45/go.mod h1:5/sjFmLb8O96B5737VCqhHyGRzNFIaN/Bu7ZodXc3qQ=
-github.com/netbirdio/wails/v3 v3.0.0-beta.3.0.20260825085513-5f07a01f7a78 h1:B/jRv24jnFeoA+VccxoCx6K94PUgsqR9wnshpeu9M+8=
-github.com/netbirdio/wails/v3 v3.0.0-beta.3.0.20260825085513-5f07a01f7a78/go.mod h1:/6QR46/nhGCSADHbS++XtDb9dkTnenTHlGskTPRo9S0=
+github.com/netbirdio/wails/v3 v3.0.0-beta.3.0.20260902163841-4a71f7b1d9e1 h1:n5aXV/U6I9bLc+yWN088TyVR4OfF64Gy+L6Hrffc+n4=
+github.com/netbirdio/wails/v3 v3.0.0-beta.3.0.20260902163841-4a71f7b1d9e1/go.mod h1:/6QR46/nhGCSADHbS++XtDb9dkTnenTHlGskTPRo9S0=
 github.com/netbirdio/wireguard-go v0.0.0-20260628102922-2834bebf6c1a h1:3CWK+yTvRKOcC0Q8VCTGy4l60TEb27CQVS7LkMxwjmw=
 github.com/netbirdio/wireguard-go v0.0.0-20260628102922-2834bebf6c1a/go.mod h1:rpwXGsirqLqN2L0JDJQlwOboGHmptD5ZD6T2VmcqhTw=
 github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A=
diff --git a/infrastructure_files/getting-started-enterprise.sh b/infrastructure_files/getting-started-enterprise.sh
index 3f7cf6357..701598a60 100755
--- a/infrastructure_files/getting-started-enterprise.sh
+++ b/infrastructure_files/getting-started-enterprise.sh
@@ -808,8 +808,9 @@ server:
 
   # Trust X-Forwarded-* only from the Traefik container's static address. Both
   # keys must stay in step with the ipv4_address pinned in docker-compose.yml:
-  # trustedPeers decides whether forwarded headers are read at all, and leaving
-  # it unset falls back to 0.0.0.0/0.
+  # trustedPeers decides whether forwarded headers are read at all. Leaving it
+  # unset trusts nothing and records Traefik's own address as every peer's
+  # connection IP.
   reverseProxy:
     trustedPeers:
       - "${TRAEFIK_IP}/32"
diff --git a/infrastructure_files/getting-started.sh b/infrastructure_files/getting-started.sh
index 5efc0181e..afbc5c282 100755
--- a/infrastructure_files/getting-started.sh
+++ b/infrastructure_files/getting-started.sh
@@ -153,6 +153,7 @@ check_domain_resolves() {
 #   NETBIRD_TRAEFIK_CERTRESOLVER      external-Traefik cert resolver (type 1)
 #   NETBIRD_BIND_LOCALHOST_ONLY       true/false (default true, types 2-5)
 #   NETBIRD_EXTERNAL_PROXY_NETWORK    docker network to join (types 2-4)
+#   NETBIRD_TRUSTED_PEERS             reverse proxy address management sees (default: built-in Traefik's IP, empty for types 1-5)
 #   NETBIRD_NON_INTERACTIVE           true forces unattended mode even with a TTY
 
 # tty_available succeeds only when we may prompt: never when the operator has
@@ -459,6 +460,8 @@ initialize_default_values() {
   MANAGEMENT_HOST_PORT="8081"  # Combined server port (management + signal + relay)
   BIND_LOCALHOST_ONLY="true"
   EXTERNAL_PROXY_NETWORK=""
+  TRUSTED_PEERS=""             # Address the reverse proxy connects to management from
+
 
   # Traefik static IP within the internal bridge network
   TRAEFIK_IP="172.30.0.10"
@@ -519,6 +522,7 @@ apply_agent_network_preset() {
   REVERSE_PROXY_TYPE="0"
   ENABLE_PROXY="true"
   ENABLE_CROWDSEC="false"
+  TRUSTED_PEERS="${NETBIRD_TRUSTED_PEERS:-$TRAEFIK_IP/32}"
 
   TRAEFIK_ACME_EMAIL=$(resolve NETBIRD_LETSENCRYPT_EMAIL required read_traefik_acme_email)
 
@@ -573,6 +577,21 @@ configure_reverse_proxy() {
     4) EXTERNAL_PROXY_NETWORK=$(resolve NETBIRD_EXTERNAL_PROXY_NETWORK "" read_proxy_docker_network "Caddy") ;;
     *) ;; # No network prompt for other options
   esac
+
+  # Only the bundled Traefik has an address we know at render time. External proxies
+  # must supply the address their proxy reaches management from.
+  if [[ "$REVERSE_PROXY_TYPE" == "0" ]]; then
+    TRUSTED_PEERS="${NETBIRD_TRUSTED_PEERS:-$TRAEFIK_IP/32}"
+  else
+    TRUSTED_PEERS="${NETBIRD_TRUSTED_PEERS:-}"
+    if [[ -z "$TRUSTED_PEERS" ]]; then
+      echo "" > /dev/stderr
+      echo "Note: reverseProxy.trustedPeers is unset, so NetBird will use the address your" > /dev/stderr
+      echo "proxy connects from as each peer's connection IP. To record real client IPs," > /dev/stderr
+      echo "set NETBIRD_TRUSTED_PEERS to your proxy's address (e.g. 172.20.0.5/32) and re-run." > /dev/stderr
+      echo "" > /dev/stderr
+    fi
+  fi
   return 0
 }
 
@@ -1033,6 +1052,7 @@ server:
   reverseProxy:
     trustedHTTPProxies:
       - "$TRAEFIK_IP/32"
+$(render_trusted_peers)
 
   store:
     engine: "sqlite"
@@ -1041,6 +1061,12 @@ EOF
   return 0
 }
 
+render_trusted_peers() {
+  if [[ -n "$TRUSTED_PEERS" ]]; then
+    printf '    trustedPeers:\n      - "%s"' "$TRUSTED_PEERS"
+  fi
+}
+
 render_dashboard_env() {
   cat <<EOF
 # Endpoints
@@ -1453,6 +1479,9 @@ location ~ ^/(relay|ws-proxy/) {
 # Native gRPC (signal + management)
 location ~ ^/(signalexchange\.SignalExchange|management\.ManagementService)/ {
     grpc_pass grpc://${server_addr};
+    # Overwrite rather than pass through: without this the client's own
+    # x-forwarded-for metadata reaches NetBird as the connection IP.
+    grpc_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
     grpc_read_timeout 1d;
     grpc_send_timeout 1d;
     grpc_socket_keepalive on;
diff --git a/infrastructure_files/management.json.tmpl b/infrastructure_files/management.json.tmpl
index 32f083917..d7832b865 100644
--- a/infrastructure_files/management.json.tmpl
+++ b/infrastructure_files/management.json.tmpl
@@ -34,9 +34,7 @@
     "ReverseProxy": {
         "TrustedHTTPProxies": [],
         "TrustedHTTPProxiesCount": 0,
-        "TrustedPeers": [
-             "0.0.0.0/0"
-        ]
+        "TrustedPeers": []
     },
     "DisableDefaultPolicy": $NETBIRD_MGMT_DISABLE_DEFAULT_POLICY,
     "Datadir": "",
diff --git a/management/cmd/root.go b/management/cmd/root.go
index 969dd60dd..ae03a09e8 100644
--- a/management/cmd/root.go
+++ b/management/cmd/root.go
@@ -54,6 +54,15 @@ func Execute() error {
 	return rootCmd.Execute()
 }
 
+// Customize hands the fully built root command to fn so an embedding binary
+// can extend or adjust the command tree — most commonly attaching its own
+// subcommands next to (or under) the built-in ones — before calling Execute.
+// The root command is constructed in this package's init, so Customize may be
+// called from the embedding binary's main at any point before Execute.
+func Customize(fn func(root *cobra.Command)) {
+	fn(rootCmd)
+}
+
 func init() {
 	mgmtCmd.Flags().IntVar(&mgmtPort, "port", 80, "server port to listen on (defaults to 443 if TLS is enabled, 80 otherwise")
 	mgmtCmd.Flags().BoolVar(&disableLegacyManagementPort, "disable-legacy-port", false, "disabling the old legacy port (33073)")
diff --git a/management/cmd/root_test.go b/management/cmd/root_test.go
new file mode 100644
index 000000000..826fd2d50
--- /dev/null
+++ b/management/cmd/root_test.go
@@ -0,0 +1,42 @@
+package cmd
+
+import (
+	"testing"
+
+	"github.com/spf13/cobra"
+)
+
+// TestCustomize verifies an embedding binary can extend the command tree: a
+// top-level command attached through the hook, and a subcommand attached under
+// the built-in admin group, are both resolvable exactly as Execute would
+// resolve them.
+func TestCustomize(t *testing.T) {
+	topLevel := &cobra.Command{Use: "some-extra", RunE: func(*cobra.Command, []string) error { return nil }}
+	nested := &cobra.Command{Use: "cluster", RunE: func(*cobra.Command, []string) error { return nil }}
+
+	Customize(func(root *cobra.Command) {
+		root.AddCommand(topLevel)
+		for _, c := range root.Commands() {
+			if c.Name() == "admin" {
+				c.AddCommand(nested)
+				return
+			}
+		}
+		t.Fatal("admin command not found in the root tree")
+	})
+	t.Cleanup(func() {
+		rootCmd.RemoveCommand(topLevel)
+		for _, c := range rootCmd.Commands() {
+			if c.Name() == "admin" {
+				c.RemoveCommand(nested)
+			}
+		}
+	})
+
+	if found, _, err := rootCmd.Find([]string{"some-extra"}); err != nil || found != topLevel {
+		t.Fatalf("top-level command not resolvable: found=%v err=%v", found, err)
+	}
+	if found, _, err := rootCmd.Find([]string{"admin", "cluster"}); err != nil || found != nested {
+		t.Fatalf("nested admin subcommand not resolvable: found=%v err=%v", found, err)
+	}
+}
diff --git a/management/internals/modules/reverseproxy/domain/domain.go b/management/internals/modules/reverseproxy/domain/domain.go
index 08d7ad19b..74583c55f 100644
--- a/management/internals/modules/reverseproxy/domain/domain.go
+++ b/management/internals/modules/reverseproxy/domain/domain.go
@@ -1,5 +1,13 @@
 package domain
 
+import "time"
+
+// ValidationTTL is the time available to validate a custom domain registration.
+const ValidationTTL = 48 * time.Hour
+
+// ID identifies a custom domain registration.
+type ID string
+
 type Type string
 
 const (
@@ -8,12 +16,13 @@ const (
 )
 
 type Domain struct {
-	ID            string `gorm:"unique;primaryKey;autoIncrement"`
-	Domain        string `gorm:"unique"` // Domain records must be unique, this avoids domain reuse across accounts.
-	AccountID     string `gorm:"index"`
-	TargetCluster string // The proxy cluster this domain should be validated against
-	Type          Type   `gorm:"-"`
-	Validated     bool
+	ID                  string `gorm:"unique;primaryKey;autoIncrement"`
+	Domain              string `gorm:"unique"` // Domain records must be unique, this avoids domain reuse across accounts.
+	AccountID           string `gorm:"index"`
+	TargetCluster       string // The proxy cluster this domain should be validated against
+	Type                Type   `gorm:"-"`
+	Validated           bool
+	ValidationExpiresAt *time.Time `gorm:"index"`
 	// SupportsCustomPorts is populated at query time for free domains from the
 	// proxy cluster capabilities. Not persisted.
 	SupportsCustomPorts *bool `gorm:"-"`
@@ -36,7 +45,12 @@ func (d *Domain) EventMeta() map[string]any {
 	}
 }
 
+// Copy returns a copy with an independent validation deadline.
 func (d *Domain) Copy() *Domain {
 	dCopy := *d
+	if d.ValidationExpiresAt != nil {
+		expiresAt := *d.ValidationExpiresAt
+		dCopy.ValidationExpiresAt = &expiresAt
+	}
 	return &dCopy
 }
diff --git a/management/internals/modules/reverseproxy/domain/manager/domain_test.go b/management/internals/modules/reverseproxy/domain/manager/domain_test.go
index 523920a99..38d5a923b 100644
--- a/management/internals/modules/reverseproxy/domain/manager/domain_test.go
+++ b/management/internals/modules/reverseproxy/domain/manager/domain_test.go
@@ -66,8 +66,8 @@ func TestExtractClusterFromFreeDomain(t *testing.T) {
 
 func TestExtractClusterFromCustomDomains(t *testing.T) {
 	customDomains := []*domain.Domain{
-		{Domain: "example.com", TargetCluster: "eu1.proxy.netbird.io"},
-		{Domain: "proxy.corp.io", TargetCluster: "us1.proxy.netbird.io"},
+		{Domain: "example.com", TargetCluster: "eu1.proxy.netbird.io", Validated: true},
+		{Domain: "proxy.corp.io", TargetCluster: "us1.proxy.netbird.io", Validated: true},
 	}
 
 	tests := []struct {
@@ -120,19 +120,49 @@ func TestExtractClusterFromCustomDomains(t *testing.T) {
 
 	for _, tc := range tests {
 		t.Run(tc.name, func(t *testing.T) {
-			cluster, ok := extractClusterFromCustomDomains(tc.domain, customDomains)
-			assert.Equal(t, tc.wantOK, ok)
-			if ok {
-				assert.Equal(t, tc.wantVal, cluster)
+			cluster, match := extractClusterFromCustomDomains(tc.domain, customDomains)
+			if !tc.wantOK {
+				assert.Equal(t, customDomainNoMatch, match, "unrelated domain should not match any custom domain")
+				return
 			}
+			assert.Equal(t, customDomainValidated, match, "validated custom domain should resolve a cluster")
+			assert.Equal(t, tc.wantVal, cluster)
 		})
 	}
 }
 
+// An unvalidated row must never yield a cluster: the account has not shown it
+// controls the name, so no service may be bound to it.
+func TestExtractClusterFromCustomDomains_UnvalidatedDomainRefused(t *testing.T) {
+	customDomains := []*domain.Domain{
+		{Domain: "example.com", TargetCluster: "eu1.proxy.netbird.io", Validated: false},
+	}
+
+	for _, serviceDomain := range []string{"example.com", "app.example.com"} {
+		t.Run(serviceDomain, func(t *testing.T) {
+			cluster, match := extractClusterFromCustomDomains(serviceDomain, customDomains)
+			assert.Equal(t, customDomainUnvalidated, match, "unvalidated row must be reported as such")
+			assert.Empty(t, cluster, "unvalidated row must not resolve a cluster")
+		})
+	}
+}
+
+// A more specific unvalidated row must not shadow a validated parent domain.
+func TestExtractClusterFromCustomDomains_ValidatedParentWinsOverUnvalidatedChild(t *testing.T) {
+	customDomains := []*domain.Domain{
+		{Domain: "example.com", TargetCluster: "cluster-generic", Validated: true},
+		{Domain: "app.example.com", TargetCluster: "cluster-app", Validated: false},
+	}
+
+	cluster, match := extractClusterFromCustomDomains("app.example.com", customDomains)
+	assert.Equal(t, customDomainValidated, match)
+	assert.Equal(t, "cluster-generic", cluster, "validated parent domain should provide the cluster")
+}
+
 func TestExtractClusterFromCustomDomains_OverlappingDomains(t *testing.T) {
 	customDomains := []*domain.Domain{
-		{Domain: "example.com", TargetCluster: "cluster-generic"},
-		{Domain: "app.example.com", TargetCluster: "cluster-app"},
+		{Domain: "example.com", TargetCluster: "cluster-generic", Validated: true},
+		{Domain: "app.example.com", TargetCluster: "cluster-app", Validated: true},
 	}
 
 	tests := []struct {
@@ -164,8 +194,8 @@ func TestExtractClusterFromCustomDomains_OverlappingDomains(t *testing.T) {
 
 	for _, tc := range tests {
 		t.Run(tc.name, func(t *testing.T) {
-			cluster, ok := extractClusterFromCustomDomains(tc.domain, customDomains)
-			assert.True(t, ok)
+			cluster, match := extractClusterFromCustomDomains(tc.domain, customDomains)
+			assert.Equal(t, customDomainValidated, match)
 			assert.Equal(t, tc.wantVal, cluster)
 		})
 	}
diff --git a/management/internals/modules/reverseproxy/domain/manager/expiration.go b/management/internals/modules/reverseproxy/domain/manager/expiration.go
new file mode 100644
index 000000000..381e3ca51
--- /dev/null
+++ b/management/internals/modules/reverseproxy/domain/manager/expiration.go
@@ -0,0 +1,73 @@
+package manager
+
+import (
+	"context"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/domain"
+	"github.com/netbirdio/netbird/management/server/activity"
+)
+
+const (
+	validationCleanupInterval = 60 * time.Minute
+	validationCleanupBatch    = 100
+)
+
+// RunValidationCleanup removes expired registrations on startup and hourly until cancellation.
+func (m Manager) RunValidationCleanup(ctx context.Context) {
+	ticker := time.NewTicker(validationCleanupInterval)
+	defer ticker.Stop()
+	for {
+		m.cleanupExpiredDomains(ctx, time.Now().UTC())
+		select {
+		case <-ctx.Done():
+			return
+		case <-ticker.C:
+		}
+	}
+}
+
+func (m Manager) cleanupExpiredDomains(ctx context.Context, now time.Time) {
+	var afterID domain.ID
+	for ctx.Err() == nil {
+		domains, err := m.store.GetExpiredCustomDomains(ctx, now, afterID, validationCleanupBatch)
+		if err != nil {
+			if ctx.Err() == nil {
+				log.WithContext(ctx).WithError(err).Error("list expired custom domain registrations")
+			}
+			return
+		}
+		for _, d := range domains {
+			if ctx.Err() != nil {
+				return
+			}
+			m.deleteExpiredDomain(ctx, d, now)
+			afterID = domain.ID(d.ID)
+		}
+		if len(domains) < validationCleanupBatch {
+			return
+		}
+	}
+}
+
+func (m Manager) deleteExpiredDomain(ctx context.Context, d *domain.Domain, now time.Time) {
+	deleted, err := m.store.DeleteExpiredCustomDomain(ctx, d, now)
+	if err != nil {
+		if ctx.Err() == nil {
+			log.WithContext(ctx).WithFields(log.Fields{"accountID": d.AccountID, "domainID": d.ID}).
+				WithError(err).Warn("could not expire custom domain registration")
+		}
+		return
+	}
+	if !deleted {
+		return
+	}
+	meta := d.EventMeta()
+	if d.ValidationExpiresAt != nil {
+		meta["validation_expires_at"] = d.ValidationExpiresAt.UTC().Format(time.RFC3339)
+	}
+	m.accountManager.StoreEvent(ctx, activity.SystemInitiator, d.ID, d.AccountID,
+		activity.CustomDomainValidationExpired, meta)
+}
diff --git a/management/internals/modules/reverseproxy/domain/manager/expiration_test.go b/management/internals/modules/reverseproxy/domain/manager/expiration_test.go
new file mode 100644
index 000000000..e3b05efbb
--- /dev/null
+++ b/management/internals/modules/reverseproxy/domain/manager/expiration_test.go
@@ -0,0 +1,274 @@
+package manager
+
+import (
+	"context"
+	"fmt"
+	"sync"
+	"testing"
+	"testing/synctest"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/domain"
+	rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
+	"github.com/netbirdio/netbird/management/server/activity"
+	"github.com/netbirdio/netbird/management/server/mock_server"
+	nbstore "github.com/netbirdio/netbird/management/server/store"
+)
+
+func TestValidateDomain_ExpiredRegistration(t *testing.T) {
+	env := setupDomainTest(t)
+	ctx := context.Background()
+	d, err := env.manager.CreateDomain(ctx, accountA, accountAUser, "expired.example.com", testCluster)
+	require.NoError(t, err)
+	expiresAt := time.Now().Add(-time.Second)
+	db := env.store.(*nbstore.SqlStore).GetDB()
+	require.NoError(t, db.Model(&domain.Domain{}).Where("id = ?", d.ID).
+		Update("validation_expires_at", expiresAt).Error)
+	env.resolver.set("validation.expired.example.com", testCluster)
+
+	env.manager.ValidateDomain(ctx, accountA, accountAUser, d.ID)
+
+	stored := storedDomain(t, env.store, accountA, d.Domain)
+	require.NotNil(t, stored)
+	assert.False(t, stored.Validated, "an expired registration must not become usable before cleanup runs")
+}
+
+func TestCreateDomain_ValidationDeadline(t *testing.T) {
+	env := setupClockDomainTest(t)
+	synctest.Test(t, func(t *testing.T) {
+		ctx := context.Background()
+		createdAt := time.Now().UTC()
+		d, err := env.manager.CreateDomain(ctx, accountA, accountAUser, "pending.example.com", testCluster)
+		require.NoError(t, err)
+		require.NotNil(t, d.ValidationExpiresAt)
+		assert.Equal(t, createdAt.Add(48*time.Hour), *d.ValidationExpiresAt, "new registrations get 48 hours")
+
+		time.Sleep(time.Hour)
+		env.manager.ValidateDomain(ctx, accountA, accountAUser, d.ID)
+		stored := storedDomain(t, env.store, accountA, d.Domain)
+		require.NotNil(t, stored)
+		require.NotNil(t, stored.ValidationExpiresAt)
+		assert.WithinDuration(t, *d.ValidationExpiresAt, *stored.ValidationExpiresAt, 0, "failed validation must not extend the deadline")
+	})
+}
+
+func TestCleanupExpiredDomains_Boundaries(t *testing.T) {
+	env := setupDomainTest(t)
+	events := captureDomainEvents(env)
+	ctx := context.Background()
+	now := time.Now().UTC().Truncate(time.Second)
+	tests := []struct {
+		name      string
+		expiresAt time.Time
+		validated bool
+		deleted   bool
+	}{
+		{"expired", now.Add(-time.Second), false, true},
+		{"deadline", now, false, true},
+		{"pending", now.Add(time.Second), false, false},
+		{"validated", now.Add(-time.Hour), true, false},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			d := createExpiringDomain(t, env, tt.name+".example.com", tt.expiresAt)
+			if tt.validated {
+				require.NoError(t, env.store.(*nbstore.SqlStore).GetDB().Model(d).Update("validated", true).Error)
+			}
+			env.manager.cleanupExpiredDomains(ctx, now)
+			stored := storedDomain(t, env.store, accountA, d.Domain)
+			if !tt.deleted {
+				assert.NotNil(t, stored, "pending and validated registrations must survive cleanup")
+				return
+			}
+			assert.Nil(t, stored, "expired unused registrations must be removed")
+			replacement, err := env.manager.CreateDomain(ctx, accountB, accountBUser, d.Domain, testCluster)
+			require.NoError(t, err)
+			assert.NotEqual(t, d.ID, replacement.ID, "the released name must receive a fresh registration")
+			assert.False(t, replacement.Validated, "the new account must validate its own registration")
+		})
+	}
+	got := events.get()
+	require.Len(t, got, 2, "only successful expiration deletions emit events")
+	for _, event := range got {
+		assert.Equal(t, activity.CustomDomainValidationExpired, event.Activity, "use the requested expiration event")
+		assert.Equal(t, activity.SystemInitiator, event.InitiatorID, "cleanup is attributed to the system")
+		assert.Equal(t, accountA, event.AccountID, "expiration belongs to the original account")
+		assert.NotEmpty(t, event.TargetID, "retain the deleted domain ID")
+		assert.NotEmpty(t, event.Meta["domain"], "retain the deleted domain name")
+		assert.NotEmpty(t, event.Meta["validation_expires_at"], "include the validation deadline")
+	}
+}
+
+func TestCleanupExpiredDomains_ContinuesPastProtectedBatch(t *testing.T) {
+	env := setupDomainTest(t)
+	ctx := context.Background()
+	now := time.Now().UTC()
+	for i := range validationCleanupBatch {
+		d := createExpiringDomain(t, env, fmt.Sprintf("protected-%d.example.com", i), now.Add(-time.Hour))
+		require.NoError(t, env.store.CreateService(ctx, &rpservice.Service{
+			ID: fmt.Sprintf("service-%d", i), AccountID: accountA, Domain: "app." + d.Domain,
+		}))
+	}
+	unprotected := createExpiringDomain(t, env, "unused.example.com", now.Add(-time.Hour))
+	env.manager.cleanupExpiredDomains(ctx, now)
+	assert.Nil(t, storedDomain(t, env.store, accountA, unprotected.Domain), "protected registrations must not starve later batches")
+	remaining, err := env.store.ListCustomDomains(ctx, accountA)
+	require.NoError(t, err)
+	assert.Len(t, remaining, validationCleanupBatch, "all registrations with dependent services must survive")
+}
+
+func TestCleanupExpiredDomains_ConcurrentWorkers(t *testing.T) {
+	env := setupDomainTest(t)
+	events := captureDomainEvents(env)
+	now := time.Now().UTC()
+	d := createExpiringDomain(t, env, "concurrent.example.com", now.Add(-time.Hour))
+	var workers sync.WaitGroup
+	for range 2 {
+		workers.Go(func() { env.manager.cleanupExpiredDomains(context.Background(), now) })
+	}
+	workers.Wait()
+	assert.Nil(t, storedDomain(t, env.store, accountA, d.Domain), "one worker must remove the expired registration")
+	assert.Len(t, events.get(), 1, "only the worker that deletes the row may emit the event")
+}
+
+func TestRunValidationCleanup_HourlyAndRestart(t *testing.T) {
+	env := setupClockDomainTest(t)
+	synctest.Test(t, func(t *testing.T) {
+		events := captureDomainEvents(env)
+		now := time.Now().UTC()
+		startup := createExpiringDomain(t, env, "startup.example.com", now.Add(-time.Hour))
+		hourly := createExpiringDomain(t, env, "hourly.example.com", now.Add(time.Minute))
+		ctx, cancel := context.WithCancel(context.Background())
+		done := make(chan struct{})
+		go func() {
+			defer close(done)
+			env.manager.RunValidationCleanup(ctx)
+		}()
+		synctest.Wait()
+		assert.Nil(t, storedDomain(t, env.store, accountA, startup.Domain), "startup must collect overdue registrations")
+		time.Sleep(59 * time.Minute)
+		synctest.Wait()
+		assert.NotNil(t, storedDomain(t, env.store, accountA, hourly.Domain), "cleanup must wait for the 60-minute interval")
+		time.Sleep(time.Minute)
+		synctest.Wait()
+		assert.Nil(t, storedDomain(t, env.store, accountA, hourly.Domain), "the hourly scan must collect expired registrations")
+		cancel()
+		<-done
+
+		offline := createExpiringDomain(t, env, "offline.example.com", time.Now().UTC().Add(time.Minute))
+		time.Sleep(2 * time.Hour)
+		assert.NotNil(t, storedDomain(t, env.store, accountA, offline.Domain), "a stopped worker must not continue deleting")
+		ctx, cancel = context.WithCancel(context.Background())
+		done = make(chan struct{})
+		go func() {
+			defer close(done)
+			env.manager.RunValidationCleanup(ctx)
+		}()
+		synctest.Wait()
+		assert.Nil(t, storedDomain(t, env.store, accountA, offline.Domain), "restart must use the persisted deadline")
+		cancel()
+		<-done
+		assert.Len(t, events.get(), 3, "each deletion should emit an expiration event")
+	})
+}
+
+type blockingDomainResolver struct {
+	started chan struct{}
+	release chan struct{}
+}
+
+func (r blockingDomainResolver) LookupCNAME(context.Context, string) (string, error) {
+	close(r.started)
+	<-r.release
+	return testCluster + ".", nil
+}
+
+func TestValidateDomain_DeadlinePassesDuringLookup(t *testing.T) {
+	for _, cleanup := range []bool{false, true} {
+		t.Run(fmt.Sprintf("cleanup=%t", cleanup), func(t *testing.T) {
+			env := setupClockDomainTest(t)
+			synctest.Test(t, func(t *testing.T) {
+				events := captureDomainEvents(env)
+				ctx := context.Background()
+				d, err := env.manager.CreateDomain(ctx, accountA, accountAUser, "late.example.com", testCluster)
+				require.NoError(t, err)
+				resolver := blockingDomainResolver{started: make(chan struct{}), release: make(chan struct{})}
+				env.manager.validator.Resolver = resolver
+				done := make(chan struct{})
+				go func() {
+					defer close(done)
+					env.manager.ValidateDomain(ctx, accountA, accountAUser, d.ID)
+				}()
+				<-resolver.started
+				time.Sleep(48 * time.Hour)
+				if cleanup {
+					env.manager.cleanupExpiredDomains(ctx, time.Now().UTC())
+					_, err = env.store.CreateCustomDomain(ctx, accountB, d.Domain, testCluster, false)
+					require.NoError(t, err)
+				}
+				close(resolver.release)
+				<-done
+				owner := accountA
+				if cleanup {
+					assert.Nil(t, storedDomain(t, env.store, accountA, d.Domain), "late validation must not restore the old claim")
+					owner = accountB
+				}
+				stored := storedDomain(t, env.store, owner, d.Domain)
+				require.NotNil(t, stored)
+				assert.False(t, stored.Validated, "late validation must not validate either claim")
+				for _, event := range events.get() {
+					assert.NotEqual(t, activity.DomainValidated, event.Activity, "a rejected write must not emit a validation event")
+				}
+			})
+		})
+	}
+}
+
+func setupClockDomainTest(t *testing.T) *domainTestEnv {
+	t.Helper()
+	// Network driver watchers cannot share cancellation channels across synctest bubbles.
+	// Store boundary and concurrency tests still exercise the selected database engine.
+	t.Setenv("NETBIRD_STORE_ENGINE", "sqlite")
+	return setupDomainTest(t)
+}
+
+func createExpiringDomain(t *testing.T, env *domainTestEnv, name string, expiresAt time.Time) *domain.Domain {
+	t.Helper()
+	d, err := env.store.CreateCustomDomain(context.Background(), accountA, name, testCluster, false)
+	require.NoError(t, err)
+	require.NoError(t, env.store.(*nbstore.SqlStore).GetDB().Model(d).Update("validation_expires_at", expiresAt).Error)
+	d.ValidationExpiresAt = &expiresAt
+	return d
+}
+
+type domainEvents struct {
+	mu     sync.Mutex
+	events []*activity.Event
+}
+
+func captureDomainEvents(env *domainTestEnv) *domainEvents {
+	events := &domainEvents{}
+	env.manager.accountManager = &mock_server.MockAccountManager{
+		StoreEventFunc: func(_ context.Context, initiator, target, account string, code activity.ActivityDescriber, meta map[string]any) {
+			if code == activity.DomainAdded {
+				return
+			}
+			events.mu.Lock()
+			defer events.mu.Unlock()
+			events.events = append(events.events, &activity.Event{
+				InitiatorID: initiator, TargetID: target, AccountID: account,
+				Activity: code.(activity.Activity), Meta: meta,
+			})
+		},
+	}
+	return events
+}
+
+func (e *domainEvents) get() []*activity.Event {
+	e.mu.Lock()
+	defer e.mu.Unlock()
+	return append([]*activity.Event(nil), e.events...)
+}
diff --git a/management/internals/modules/reverseproxy/domain/manager/manager.go b/management/internals/modules/reverseproxy/domain/manager/manager.go
index a9774d0e9..c0fb12e9c 100644
--- a/management/internals/modules/reverseproxy/domain/manager/manager.go
+++ b/management/internals/modules/reverseproxy/domain/manager/manager.go
@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"net"
 	"strings"
+	"time"
 
 	log "github.com/sirupsen/logrus"
 
@@ -18,6 +19,7 @@ import (
 	"github.com/netbirdio/netbird/management/server/permissions/operations"
 	nbstore "github.com/netbirdio/netbird/management/server/store"
 	"github.com/netbirdio/netbird/management/server/types"
+	nbdomain "github.com/netbirdio/netbird/shared/management/domain"
 	"github.com/netbirdio/netbird/shared/management/status"
 )
 
@@ -26,11 +28,14 @@ type store interface {
 	GetAgentNetworkSettings(ctx context.Context, lockStrength nbstore.LockingStrength, accountID string) (*agentnetworkTypes.Settings, error)
 
 	GetCustomDomain(ctx context.Context, accountID string, domainID string) (*domain.Domain, error)
+	GetCustomDomainByName(ctx context.Context, domainName string) (*domain.Domain, error)
 	ListFreeDomains(ctx context.Context, accountID string) ([]string, error)
 	ListCustomDomains(ctx context.Context, accountID string) ([]*domain.Domain, error)
 	CreateCustomDomain(ctx context.Context, accountID string, domainName string, targetCluster string, validated bool) (*domain.Domain, error)
 	UpdateCustomDomain(ctx context.Context, accountID string, d *domain.Domain) (*domain.Domain, error)
 	DeleteCustomDomain(ctx context.Context, accountID string, domainID string) error
+	GetExpiredCustomDomains(ctx context.Context, now time.Time, afterID domain.ID, limit int) ([]*domain.Domain, error)
+	DeleteExpiredCustomDomain(ctx context.Context, d *domain.Domain, now time.Time) (bool, error)
 }
 
 type proxyManager interface {
@@ -105,12 +110,13 @@ func (m Manager) GetDomains(ctx context.Context, accountID, userID string) ([]*d
 	// Add custom domains.
 	for _, d := range domains {
 		cd := &domain.Domain{
-			ID:            d.ID,
-			Domain:        d.Domain,
-			AccountID:     accountID,
-			TargetCluster: d.TargetCluster,
-			Type:          domain.TypeCustom,
-			Validated:     d.Validated,
+			ID:                  d.ID,
+			Domain:              d.Domain,
+			AccountID:           accountID,
+			TargetCluster:       d.TargetCluster,
+			Type:                domain.TypeCustom,
+			Validated:           d.Validated,
+			ValidationExpiresAt: d.ValidationExpiresAt,
 		}
 		if d.TargetCluster != "" {
 			cd.SupportsCustomPorts = m.proxyManager.ClusterSupportsCustomPorts(ctx, d.TargetCluster)
@@ -125,6 +131,7 @@ func (m Manager) GetDomains(ctx context.Context, accountID, userID string) ([]*d
 	return ret, nil
 }
 
+// CreateDomain registers a normalized custom domain and attempts DNS validation.
 func (m Manager) CreateDomain(ctx context.Context, accountID, userID, domainName, targetCluster string) (*domain.Domain, error) {
 	ok, ctx, err := m.permissionsManager.ValidateUserPermissions(ctx, accountID, userID, modules.Services, operations.Create)
 	if err != nil {
@@ -134,6 +141,15 @@ func (m Manager) CreateDomain(ctx context.Context, accountID, userID, domainName
 		return nil, status.NewPermissionDeniedError()
 	}
 
+	parsed, err := nbdomain.FromString(strings.TrimSuffix(domainName, "."))
+	if err != nil {
+		return nil, status.Errorf(status.InvalidArgument, "invalid domain: %v", err)
+	}
+	domainName = parsed.PunycodeString()
+	if !nbdomain.IsValidDomainNoWildcard(domainName) {
+		return nil, status.Errorf(status.InvalidArgument, "invalid domain format")
+	}
+
 	// Verify the target cluster is in the available clusters for this account
 	allowList, err := m.getClusterAllowList(ctx, accountID)
 	if err != nil {
@@ -150,6 +166,10 @@ func (m Manager) CreateDomain(ctx context.Context, accountID, userID, domainName
 		return nil, fmt.Errorf("target cluster %s is not available", targetCluster)
 	}
 
+	if err := m.checkDomainAvailable(ctx, domainName); err != nil {
+		return nil, err
+	}
+
 	// Attempt an initial validation against the specified cluster only
 	var validated bool
 	if m.validator.IsValid(ctx, domainName, []string{targetCluster}) {
@@ -166,6 +186,23 @@ func (m Manager) CreateDomain(ctx context.Context, accountID, userID, domainName
 	return d, nil
 }
 
+// checkDomainAvailable reports whether the domain is free to claim. The unique
+// index on the column is the real guard; this turns the violation into a
+// conflict the caller can act on instead of a database error, and says nothing
+// about which account holds the domain.
+func (m Manager) checkDomainAvailable(ctx context.Context, domainName string) error {
+	_, err := m.store.GetCustomDomainByName(ctx, domainName)
+	if err == nil {
+		return status.Errorf(status.AlreadyExists, "domain %s is already registered", domainName)
+	}
+
+	if sErr, ok := status.FromError(err); ok && sErr.Type() == status.NotFound {
+		return nil
+	}
+
+	return fmt.Errorf("look up domain: %w", err)
+}
+
 func (m Manager) DeleteDomain(ctx context.Context, accountID, userID, domainID string) error {
 	ok, ctx, err := m.permissionsManager.ValidateUserPermissions(ctx, accountID, userID, modules.Services, operations.Delete)
 	if err != nil {
@@ -203,7 +240,9 @@ func (m Manager) ValidateDomain(ctx context.Context, accountID, userID, domainID
 		log.WithFields(log.Fields{
 			"accountID": accountID,
 			"domainID":  domainID,
-		}).WithError(err).Error("validate domain")
+			"userID":    userID,
+		}).Error("validate domain: permission denied")
+		return
 	}
 
 	log.WithFields(log.Fields{
@@ -219,6 +258,14 @@ func (m Manager) ValidateDomain(ctx context.Context, accountID, userID, domainID
 		}).WithError(err).Error("get custom domain from store")
 		return
 	}
+	if d.Validated {
+		return
+	}
+	if d.ValidationExpiresAt == nil || !time.Now().Before(*d.ValidationExpiresAt) {
+		log.WithFields(log.Fields{"accountID": accountID, "domainID": domainID}).
+			Debug("custom domain validation window has expired")
+		return
+	}
 
 	// Validate only against the domain's target cluster
 	targetCluster := d.TargetCluster
@@ -239,20 +286,21 @@ func (m Manager) ValidateDomain(ctx context.Context, accountID, userID, domainID
 	}).Info("validating domain against target cluster")
 
 	if m.validator.IsValid(context.Background(), d.Domain, []string{targetCluster}) {
-		log.WithFields(log.Fields{
-			"accountID": accountID,
-			"domainID":  domainID,
-			"domain":    d.Domain,
-		}).Info("domain validated successfully")
 		d.Validated = true
 		if _, err := m.store.UpdateCustomDomain(context.Background(), accountID, d); err != nil {
-			log.WithFields(log.Fields{
+			entry := log.WithFields(log.Fields{
 				"accountID": accountID,
 				"domainID":  domainID,
-				"domain":    d.Domain,
-			}).WithError(err).Error("update custom domain in store")
+			}).WithError(err)
+			if sErr, ok := status.FromError(err); ok && sErr.Type() == status.PreconditionFailed {
+				entry.Debug("custom domain registration is no longer pending validation")
+				return
+			}
+			entry.Error("update custom domain in store")
 			return
 		}
+		log.WithFields(log.Fields{"accountID": accountID, "domainID": domainID}).
+			Info("custom domain validated successfully")
 
 		m.accountManager.StoreEvent(context.Background(), userID, domainID, accountID, activity.DomainValidated, d.EventMeta())
 	} else {
@@ -298,9 +346,12 @@ func (m Manager) DeriveClusterFromDomain(ctx context.Context, accountID, domain
 		return "", fmt.Errorf("list custom domains: %w", err)
 	}
 
-	targetCluster, valid := extractClusterFromCustomDomains(domain, customDomains)
-	if valid {
+	targetCluster, match := extractClusterFromCustomDomains(domain, customDomains)
+	switch match {
+	case customDomainValidated:
 		return targetCluster, nil
+	case customDomainUnvalidated:
+		return "", status.Errorf(status.PreconditionFailed, "domain %s is not validated", domain)
 	}
 
 	return "", fmt.Errorf("domain %s does not match any available proxy cluster", domain)
@@ -363,19 +414,46 @@ func (m Manager) reservedGatewayAddress(ctx context.Context, accountID string) (
 	return settings.ProxyAddress, nil
 }
 
-func extractClusterFromCustomDomains(serviceDomain string, customDomains []*domain.Domain) (string, bool) {
+// customDomainMatch describes how a service domain relates to the account's
+// custom domain rows.
+type customDomainMatch int
+
+const (
+	customDomainNoMatch customDomainMatch = iota
+	customDomainUnvalidated
+	customDomainValidated
+)
+
+// extractClusterFromCustomDomains finds the longest custom domain covering the
+// service domain and reports its target cluster. Only a validated row yields a
+// cluster: until the CNAME check has passed the account has not shown it
+// controls the name, so no traffic may be routed for it.
+func extractClusterFromCustomDomains(serviceDomain string, customDomains []*domain.Domain) (string, customDomainMatch) {
 	bestCluster := ""
 	bestLen := -1
+	matched := false
 	for _, cd := range customDomains {
 		if serviceDomain != cd.Domain && !strings.HasSuffix(serviceDomain, "."+cd.Domain) {
 			continue
 		}
+		matched = true
+		if !cd.Validated {
+			continue
+		}
 		if l := len(cd.Domain); l > bestLen {
 			bestLen = l
 			bestCluster = cd.TargetCluster
 		}
 	}
-	return bestCluster, bestLen >= 0
+
+	switch {
+	case bestLen >= 0:
+		return bestCluster, customDomainValidated
+	case matched:
+		return "", customDomainUnvalidated
+	default:
+		return "", customDomainNoMatch
+	}
 }
 
 // ExtractClusterFromFreeDomain extracts the cluster address from a free domain.
diff --git a/management/internals/modules/reverseproxy/domain/manager/manager_realstore_test.go b/management/internals/modules/reverseproxy/domain/manager/manager_realstore_test.go
new file mode 100644
index 000000000..5c973c40e
--- /dev/null
+++ b/management/internals/modules/reverseproxy/domain/manager/manager_realstore_test.go
@@ -0,0 +1,321 @@
+package manager
+
+import (
+	"context"
+	"fmt"
+	"sync"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.opentelemetry.io/otel/metric/noop"
+
+	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/domain"
+	proxymanager "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/proxy/manager"
+	"github.com/netbirdio/netbird/management/server/activity"
+	"github.com/netbirdio/netbird/management/server/mock_server"
+	"github.com/netbirdio/netbird/management/server/permissions"
+	nbstore "github.com/netbirdio/netbird/management/server/store"
+	"github.com/netbirdio/netbird/management/server/types"
+	"github.com/netbirdio/netbird/shared/management/status"
+)
+
+const (
+	testCluster    = "eu.proxy.test"
+	accountA       = "account-a"
+	accountAUser   = "account-a-admin"
+	accountB       = "account-b"
+	accountBUser   = "account-b-admin"
+	accountAMember = "account-a-member"
+)
+
+// stubResolver answers CNAME lookups from a table the test controls, so a
+// domain can point at the cluster or nowhere without touching a real resolver.
+type stubResolver struct {
+	mu     sync.Mutex
+	cnames map[string]string
+}
+
+func (r *stubResolver) LookupCNAME(_ context.Context, host string) (string, error) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+
+	cname, ok := r.cnames[host]
+	if !ok {
+		return "", fmt.Errorf("lookup %s: no such host", host)
+	}
+	return cname + ".", nil
+}
+
+func (r *stubResolver) set(host, cname string) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	r.cnames[host] = cname
+}
+
+type domainTestEnv struct {
+	manager  Manager
+	store    nbstore.Store
+	resolver *stubResolver
+}
+
+// setupDomainTest builds the domain manager on a real SQLite store with two
+// accounts and one active public proxy cluster.
+func setupDomainTest(t *testing.T) *domainTestEnv {
+	t.Helper()
+
+	ctx := context.Background()
+	testStore, cleanup, err := nbstore.NewTestStoreFromSQL(ctx, "", t.TempDir())
+	require.NoError(t, err)
+	t.Cleanup(cleanup)
+
+	for accountID, userID := range map[string]string{accountA: accountAUser, accountB: accountBUser} {
+		users := map[string]*types.User{
+			userID: {
+				Id:        userID,
+				AccountID: accountID,
+				Role:      types.UserRoleAdmin,
+			},
+		}
+		if accountID == accountA {
+			// A real member of the account whose role denies Services:Create, so
+			// permission denial is exercised as ok=false rather than as a lookup
+			// error for a user who is not in the account at all.
+			users[accountAMember] = &types.User{
+				Id:        accountAMember,
+				AccountID: accountID,
+				Role:      types.UserRoleUser,
+			}
+		}
+
+		require.NoError(t, testStore.SaveAccount(ctx, &types.Account{
+			Id:        accountID,
+			CreatedBy: userID,
+			Settings:  &types.Settings{},
+			Users:     users,
+		}))
+	}
+
+	proxyMgr, err := proxymanager.NewManager(testStore, noop.NewMeterProvider().Meter(""))
+	require.NoError(t, err)
+
+	_, err = proxyMgr.Connect(ctx, "proxy-1", "session-1", testCluster, "127.0.0.1", nil, nil)
+	require.NoError(t, err)
+
+	resolver := &stubResolver{cnames: make(map[string]string)}
+
+	mgr := Manager{
+		store:              testStore,
+		proxyManager:       proxyMgr,
+		validator:          domain.Validator{Resolver: resolver},
+		permissionsManager: permissions.NewManager(testStore),
+		accountManager: &mock_server.MockAccountManager{
+			StoreEventFunc: func(context.Context, string, string, string, activity.ActivityDescriber, map[string]any) {},
+		},
+	}
+
+	return &domainTestEnv{manager: mgr, store: testStore, resolver: resolver}
+}
+
+// storedDomain reads a domain row back through the store so assertions are made
+// on what was persisted rather than on the value the manager returned.
+func storedDomain(t *testing.T, s nbstore.Store, accountID, domainName string) *domain.Domain {
+	t.Helper()
+
+	domains, err := s.ListCustomDomains(context.Background(), accountID)
+	require.NoError(t, err)
+	for _, d := range domains {
+		if d.Domain == domainName {
+			return d
+		}
+	}
+	return nil
+}
+
+// A domain whose CNAME check fails is stored unvalidated and must not resolve a
+// cluster, which is what service creation gates on.
+func TestCreateDomain_FailedLookupIsNotServable(t *testing.T) {
+	ctx := context.Background()
+	env := setupDomainTest(t)
+
+	created, err := env.manager.CreateDomain(ctx, accountA, accountAUser, "apps.example.com", testCluster)
+	require.NoError(t, err)
+	assert.False(t, created.Validated, "a domain whose CNAME lookup fails must not be created validated")
+
+	stored := storedDomain(t, env.store, accountA, "apps.example.com")
+	require.NotNil(t, stored, "domain row should exist")
+	assert.False(t, stored.Validated, "persisted row must be unvalidated")
+
+	cluster, err := env.manager.DeriveClusterFromDomain(ctx, accountA, "apps.example.com")
+	require.Error(t, err, "an unvalidated domain must not resolve a cluster")
+	assert.Empty(t, cluster)
+	assert.Contains(t, err.Error(), "not validated", "error should tell the caller what to fix")
+
+	sErr, ok := status.FromError(err)
+	require.True(t, ok, "error should be a typed status error")
+	assert.Equal(t, status.PreconditionFailed, sErr.Type())
+
+	_, err = env.manager.DeriveClusterFromDomain(ctx, accountA, "sub.apps.example.com")
+	assert.Error(t, err, "subdomains of an unvalidated custom domain are not servable either")
+}
+
+// A second account claiming a registered domain gets a clean conflict, not a
+// database error surfaced as a 500.
+func TestCreateDomain_DuplicateIsAConflict(t *testing.T) {
+	ctx := context.Background()
+	env := setupDomainTest(t)
+
+	_, err := env.manager.CreateDomain(ctx, accountA, accountAUser, "shared.example.com", testCluster)
+	require.NoError(t, err)
+
+	_, err = env.manager.CreateDomain(ctx, accountB, accountBUser, "shared.example.com", testCluster)
+	require.Error(t, err)
+
+	sErr, ok := status.FromError(err)
+	require.True(t, ok, "conflict must be a typed status error, not a raw database error")
+	assert.Equal(t, status.AlreadyExists, sErr.Type(), "conflict should map to 409, not 500")
+	assert.NotContains(t, sErr.Message, accountA, "the response must not reveal the holding account")
+
+	assert.Nil(t, storedDomain(t, env.store, accountB, "shared.example.com"), "no row should be written on conflict")
+}
+
+// The same account re-adding one of its own domains is a conflict too.
+func TestCreateDomain_SameAccountDuplicateIsAConflict(t *testing.T) {
+	ctx := context.Background()
+	env := setupDomainTest(t)
+
+	_, err := env.manager.CreateDomain(ctx, accountA, accountAUser, "dup.example.com", testCluster)
+	require.NoError(t, err)
+
+	_, err = env.manager.CreateDomain(ctx, accountA, accountAUser, "dup.example.com", testCluster)
+	require.Error(t, err)
+
+	sErr, ok := status.FromError(err)
+	require.True(t, ok)
+	assert.Equal(t, status.AlreadyExists, sErr.Type())
+}
+
+// The negative control: a validated domain still derives its cluster, for the
+// bare name and for subdomains, exactly as before.
+func TestCreateDomain_ValidatedDomainDerivesCluster(t *testing.T) {
+	ctx := context.Background()
+	env := setupDomainTest(t)
+	env.resolver.set("validation.valid.example.com", testCluster)
+
+	created, err := env.manager.CreateDomain(ctx, accountA, accountAUser, "valid.example.com", testCluster)
+	require.NoError(t, err)
+	require.True(t, created.Validated, "a matching CNAME should validate on create")
+
+	cluster, err := env.manager.DeriveClusterFromDomain(ctx, accountA, "valid.example.com")
+	require.NoError(t, err)
+	assert.Equal(t, testCluster, cluster)
+
+	cluster, err = env.manager.DeriveClusterFromDomain(ctx, accountA, "app.valid.example.com")
+	require.NoError(t, err)
+	assert.Equal(t, testCluster, cluster, "subdomains of a validated custom domain resolve too")
+}
+
+// Validating a domain flips the gate: the same lookup that failed before now
+// resolves a cluster.
+func TestValidateDomain_UnlocksClusterDerivation(t *testing.T) {
+	ctx := context.Background()
+	env := setupDomainTest(t)
+
+	created, err := env.manager.CreateDomain(ctx, accountA, accountAUser, "later.example.com", testCluster)
+	require.NoError(t, err)
+	require.False(t, created.Validated)
+
+	_, err = env.manager.DeriveClusterFromDomain(ctx, accountA, "later.example.com")
+	require.Error(t, err)
+
+	env.resolver.set("validation.later.example.com", testCluster)
+	env.manager.ValidateDomain(ctx, accountA, accountAUser, created.ID)
+
+	require.True(t, storedDomain(t, env.store, accountA, "later.example.com").Validated)
+
+	cluster, err := env.manager.DeriveClusterFromDomain(ctx, accountA, "later.example.com")
+	require.NoError(t, err)
+	assert.Equal(t, testCluster, cluster)
+}
+
+// Free cluster domains are unaffected by the custom domain gate.
+func TestDeriveClusterFromDomain_FreeDomainUnaffected(t *testing.T) {
+	ctx := context.Background()
+	env := setupDomainTest(t)
+
+	cluster, err := env.manager.DeriveClusterFromDomain(ctx, accountA, "myapp.abc123."+testCluster)
+	require.NoError(t, err)
+	assert.Equal(t, testCluster, cluster)
+}
+
+// The manager pre-check exists to turn a conflict into a 409, but the unique
+// index on the column is what actually guarantees the domain is claimed once.
+//
+// Two requests can clear the pre-check concurrently and race to the insert.
+// Inserting twice through the store reaches the same code path the loser of
+// that race takes, without the nondeterminism of driving it from goroutines,
+// and the loser must still see a conflict rather than an internal error.
+func TestStore_DuplicateDomainRejectedByIndexAsConflict(t *testing.T) {
+	ctx := context.Background()
+	env := setupDomainTest(t)
+
+	_, err := env.store.CreateCustomDomain(ctx, accountA, "indexed.example.com", testCluster, false)
+	require.NoError(t, err)
+
+	_, err = env.store.CreateCustomDomain(ctx, accountB, "indexed.example.com", testCluster, false)
+	require.Error(t, err, "the unique index must reject the same domain in a second account")
+
+	sErr, ok := status.FromError(err)
+	require.True(t, ok, "the losing insert must return a typed status error")
+	assert.Equal(t, status.AlreadyExists, sErr.Type(), "a lost race is a 409, not a 500")
+}
+
+// Validation is what decides whether a domain routes traffic, so a caller
+// without permission to it must not be able to flip the flag. The check logged
+// the denial and then carried on, which was inert while nothing read Validated
+// and is not once cluster derivation gates on it.
+func TestValidateDomain_PermissionDeniedDoesNotValidate(t *testing.T) {
+	ctx := context.Background()
+	env := setupDomainTest(t)
+
+	created, err := env.manager.CreateDomain(ctx, accountA, accountAUser, "guarded.example.com", testCluster)
+	require.NoError(t, err)
+	require.False(t, created.Validated)
+
+	// The CNAME is in place, so the only thing standing between this caller and
+	// a validated domain is the permission check.
+	env.resolver.set("validation.guarded.example.com", testCluster)
+
+	env.manager.ValidateDomain(ctx, accountA, accountAMember, created.ID)
+
+	stored := storedDomain(t, env.store, accountA, "guarded.example.com")
+	require.NotNil(t, stored)
+	assert.False(t, stored.Validated, "a caller without permission must not validate the domain")
+
+	_, err = env.manager.DeriveClusterFromDomain(ctx, accountA, "guarded.example.com")
+	assert.Error(t, err, "the domain must still be unservable")
+}
+
+// A validation finishing after deletion must reject the stale write, without
+// restoring the registration or reporting successful validation.
+func TestUpdateCustomDomain_DoesNotResurrectDeletedDomain(t *testing.T) {
+	ctx := context.Background()
+	env := setupDomainTest(t)
+
+	created, err := env.manager.CreateDomain(ctx, accountA, accountAUser, "racy.example.com", testCluster)
+	require.NoError(t, err)
+
+	stale := storedDomain(t, env.store, accountA, "racy.example.com")
+	require.NotNil(t, stale)
+
+	require.NoError(t, env.manager.DeleteDomain(ctx, accountA, accountAUser, created.ID))
+	require.Nil(t, storedDomain(t, env.store, accountA, "racy.example.com"), "the domain should be gone")
+
+	// What an in-flight validation would write once its CNAME check succeeded.
+	stale.Validated = true
+	_, err = env.store.UpdateCustomDomain(ctx, accountA, stale)
+	require.Error(t, err, "a deleted registration must reject a late validation")
+
+	assert.Nil(t, storedDomain(t, env.store, accountA, "racy.example.com"),
+		"a late validation write must not recreate a deleted domain")
+}
diff --git a/management/internals/modules/reverseproxy/domain/manager/manager_test.go b/management/internals/modules/reverseproxy/domain/manager/manager_test.go
index 12281b447..1ca690130 100644
--- a/management/internals/modules/reverseproxy/domain/manager/manager_test.go
+++ b/management/internals/modules/reverseproxy/domain/manager/manager_test.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"errors"
 	"testing"
+	"time"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -184,6 +185,10 @@ func (s *stubStore) GetCustomDomain(context.Context, string, string) (*domain.Do
 	panic("not used in allow-list tests")
 }
 
+func (s *stubStore) GetCustomDomainByName(context.Context, string) (*domain.Domain, error) {
+	panic("not used in allow-list tests")
+}
+
 func (s *stubStore) ListFreeDomains(context.Context, string) ([]string, error) {
 	panic("not used in allow-list tests")
 }
@@ -204,6 +209,14 @@ func (s *stubStore) DeleteCustomDomain(context.Context, string, string) error {
 	panic("not used in allow-list tests")
 }
 
+func (s *stubStore) GetExpiredCustomDomains(context.Context, time.Time, domain.ID, int) ([]*domain.Domain, error) {
+	panic("not used in allow-list tests")
+}
+
+func (s *stubStore) DeleteExpiredCustomDomain(context.Context, *domain.Domain, time.Time) (bool, error) {
+	panic("not used in allow-list tests")
+}
+
 // TestGetClusterAllowList_DedicatedGatewayAddressExcluded pins invariant (B)'s
 // chokepoint: a self-addressed settings pin reserves the account's gateway
 // address, so it is dropped from the allow list — which, because the
diff --git a/management/internals/modules/reverseproxy/domain/manager/normalization_test.go b/management/internals/modules/reverseproxy/domain/manager/normalization_test.go
new file mode 100644
index 000000000..da5e4bdd1
--- /dev/null
+++ b/management/internals/modules/reverseproxy/domain/manager/normalization_test.go
@@ -0,0 +1,83 @@
+package manager
+
+import (
+	"context"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/shared/management/status"
+)
+
+func TestCreateDomain_NormalizesName(t *testing.T) {
+	for _, tt := range []struct {
+		name      string
+		input     string
+		canonical string
+	}{
+		{"mixed case", "Apps.Example.COM", "apps.example.com"},
+		{"unicode", "münchen.example.com", "xn--mnchen-3ya.example.com"},
+		{"trailing dot", "apps.example.com.", "apps.example.com"},
+		{"underscore", "My_App.example.com", "my_app.example.com"},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			ctx := context.Background()
+			env := setupDomainTest(t)
+			env.resolver.set("validation."+tt.canonical, testCluster)
+
+			created, err := env.manager.CreateDomain(ctx, accountA, accountAUser, tt.input, testCluster)
+			require.NoError(t, err)
+			assert.Equal(t, tt.canonical, created.Domain, "the response must use the normalized name")
+			assert.True(t, created.Validated, "the CNAME lookup must use the normalized name")
+			stored, err := env.store.GetCustomDomain(ctx, accountA, created.ID)
+			require.NoError(t, err)
+			assert.Equal(t, tt.canonical, stored.Domain, "the database must retain the normalized name")
+
+			_, err = env.manager.CreateDomain(ctx, accountB, accountBUser, tt.canonical, testCluster)
+			require.Error(t, err)
+			sErr, ok := status.FromError(err)
+			require.True(t, ok, "an equivalent name must return a typed conflict")
+			assert.Equal(t, status.AlreadyExists, sErr.Type(), "normalization must precede the availability check")
+		})
+	}
+}
+
+func TestCreateDomain_NormalizedNameCanValidateLater(t *testing.T) {
+	ctx := context.Background()
+	env := setupDomainTest(t)
+	created, err := env.manager.CreateDomain(ctx, accountA, accountAUser, "Apps.Example.COM.", testCluster)
+	require.NoError(t, err)
+	require.False(t, created.Validated, "a missing CNAME must leave the normalized registration pending")
+
+	env.resolver.set("validation.apps.example.com", testCluster)
+	env.manager.ValidateDomain(ctx, accountA, accountAUser, created.ID)
+	stored, err := env.store.GetCustomDomain(ctx, accountA, created.ID)
+	require.NoError(t, err)
+	assert.Equal(t, "apps.example.com", stored.Domain, "retrying validation must retain the normalized name")
+	assert.True(t, stored.Validated, "later validation must look up the normalized name")
+}
+
+func TestCreateDomain_RejectsInvalidName(t *testing.T) {
+	ctx := context.Background()
+	env := setupDomainTest(t)
+	for _, name := range []string{
+		"", ".", "app..example.com", "app.example.com..", "-app.example.com",
+		"app%.example.com", "app!.example.com", "*.example.com", "app example.com",
+		"https://example.com", strings.Repeat("a", 64) + ".example.com",
+	} {
+		t.Run(name, func(t *testing.T) {
+			// A matching DNS response must not make a malformed name acceptable.
+			env.resolver.set("validation."+name, testCluster)
+			_, err := env.manager.CreateDomain(ctx, accountA, accountAUser, name, testCluster)
+			require.Error(t, err)
+			sErr, ok := status.FromError(err)
+			require.True(t, ok, "invalid names must return a typed client error")
+			assert.Equal(t, status.InvalidArgument, sErr.Type(), "malformed names must be rejected before storage")
+		})
+	}
+	stored, err := env.store.ListCustomDomains(ctx, accountA)
+	require.NoError(t, err)
+	assert.Empty(t, stored, "invalid registration attempts must not reserve any names")
+}
diff --git a/management/internals/modules/reverseproxy/service/manager/domain_validation_test.go b/management/internals/modules/reverseproxy/service/manager/domain_validation_test.go
new file mode 100644
index 000000000..ccb955cd8
--- /dev/null
+++ b/management/internals/modules/reverseproxy/service/manager/domain_validation_test.go
@@ -0,0 +1,127 @@
+package manager
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.opentelemetry.io/otel/metric/noop"
+
+	domainmanager "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/domain/manager"
+	proxymanager "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/proxy/manager"
+	rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
+	"github.com/netbirdio/netbird/management/server/activity"
+	"github.com/netbirdio/netbird/management/server/mock_server"
+	"github.com/netbirdio/netbird/management/server/permissions"
+	"github.com/netbirdio/netbird/management/server/store"
+	"github.com/netbirdio/netbird/shared/management/status"
+)
+
+const validationTestCluster = "eu.proxy.test"
+
+// withRealDomainManager swaps the stub cluster deriver for the real domain
+// manager backed by the same store, so service creation is gated by the actual
+// domain rows rather than by a test double that always agrees.
+func withRealDomainManager(t *testing.T, mgr *Manager, testStore store.Store) {
+	t.Helper()
+
+	ctx := context.Background()
+	proxyMgr, err := proxymanager.NewManager(testStore, noop.NewMeterProvider().Meter(""))
+	require.NoError(t, err)
+
+	_, err = proxyMgr.Connect(ctx, "proxy-1", "session-1", validationTestCluster, "127.0.0.1", nil, nil)
+	require.NoError(t, err)
+
+	accountMgr := &mock_server.MockAccountManager{
+		StoreEventFunc: func(context.Context, string, string, string, activity.ActivityDescriber, map[string]any) {},
+	}
+	mgr.clusterDeriver = domainmanager.NewManager(testStore, proxyMgr, permissions.NewManager(testStore), accountMgr)
+}
+
+func newTestService(domain string) *rpservice.Service {
+	return &rpservice.Service{
+		Name:    "test-service",
+		Domain:  domain,
+		Enabled: true,
+		Mode:    rpservice.ModeHTTP,
+		Targets: []*rpservice.Target{{
+			Host:       "10.0.0.1",
+			Port:       8080,
+			Protocol:   "http",
+			TargetId:   testPeerID,
+			TargetType: "peer",
+			Enabled:    true,
+		}},
+	}
+}
+
+// A service must not bind to a domain the account has not validated, and
+// nothing may be persisted for the attempt.
+func TestCreateService_RefusesUnvalidatedDomain(t *testing.T) {
+	ctx := context.Background()
+	mgr, testStore := setupIntegrationTest(t)
+	withRealDomainManager(t, mgr, testStore)
+
+	_, err := testStore.CreateCustomDomain(ctx, testAccountID, "unproven.example.com", validationTestCluster, false)
+	require.NoError(t, err)
+
+	_, err = mgr.CreateService(ctx, testAccountID, testUserID, newTestService("unproven.example.com"))
+	require.Error(t, err, "an unvalidated domain must not bind a service")
+	assert.Contains(t, err.Error(), "not validated", "the API error should name the actual problem")
+
+	sErr, ok := status.FromError(err)
+	require.True(t, ok, "error should be a typed status error")
+	assert.Equal(t, status.PreconditionFailed, sErr.Type())
+
+	services, err := testStore.GetAccountServices(ctx, store.LockingStrengthNone, testAccountID)
+	require.NoError(t, err)
+	assert.Empty(t, services, "no service row should be written for a refused domain")
+}
+
+// The negative control: a validated domain still binds a service and derives
+// its cluster exactly as before.
+func TestCreateService_ValidatedDomainBindsService(t *testing.T) {
+	ctx := context.Background()
+	mgr, testStore := setupIntegrationTest(t)
+	withRealDomainManager(t, mgr, testStore)
+
+	_, err := testStore.CreateCustomDomain(ctx, testAccountID, "proven.example.com", validationTestCluster, true)
+	require.NoError(t, err)
+
+	created, err := mgr.CreateService(ctx, testAccountID, testUserID, newTestService("app.proven.example.com"))
+	require.NoError(t, err)
+	assert.Equal(t, validationTestCluster, created.ProxyCluster, "service should bind to the domain's target cluster")
+
+	services, err := testStore.GetAccountServices(ctx, store.LockingStrengthNone, testAccountID)
+	require.NoError(t, err)
+	require.Len(t, services, 1, "the service should be persisted")
+	assert.Equal(t, "app.proven.example.com", services[0].Domain)
+}
+
+// An update must not be a way around the creation gate: moving a live service
+// onto an unvalidated domain has to fail rather than silently keep the old
+// cluster and start serving the new hostname.
+func TestUpdateService_RefusesMoveToUnvalidatedDomain(t *testing.T) {
+	ctx := context.Background()
+	mgr, testStore := setupIntegrationTest(t)
+	withRealDomainManager(t, mgr, testStore)
+
+	_, err := testStore.CreateCustomDomain(ctx, testAccountID, "proven.example.com", validationTestCluster, true)
+	require.NoError(t, err)
+	_, err = testStore.CreateCustomDomain(ctx, testAccountID, "unproven.example.com", validationTestCluster, false)
+	require.NoError(t, err)
+
+	created, err := mgr.CreateService(ctx, testAccountID, testUserID, newTestService("app.proven.example.com"))
+	require.NoError(t, err)
+
+	moved := *created
+	moved.Domain = "app.unproven.example.com"
+	_, err = mgr.UpdateService(ctx, testAccountID, testUserID, &moved)
+	require.Error(t, err, "moving to an unvalidated domain must fail")
+	assert.Contains(t, err.Error(), "not validated")
+
+	stored, err := testStore.GetServiceByID(ctx, store.LockingStrengthNone, testAccountID, created.ID)
+	require.NoError(t, err)
+	assert.Equal(t, "app.proven.example.com", stored.Domain, "the service must keep its original domain")
+}
diff --git a/management/internals/modules/reverseproxy/service/manager/manager.go b/management/internals/modules/reverseproxy/service/manager/manager.go
index 365fbab40..9c7f95eb4 100644
--- a/management/internals/modules/reverseproxy/service/manager/manager.go
+++ b/management/internals/modules/reverseproxy/service/manager/manager.go
@@ -606,16 +606,19 @@ func (m *Manager) resolveEffectiveCluster(ctx context.Context, accountID string,
 		return existing.ProxyCluster, nil
 	}
 
-	if m.clusterDeriver != nil {
-		derived, err := m.clusterDeriver.DeriveClusterFromDomain(ctx, accountID, svc.Domain)
-		if err != nil {
-			log.WithError(err).Warnf("could not derive cluster from domain %s", svc.Domain)
-		} else {
-			return derived, nil
-		}
+	if m.clusterDeriver == nil {
+		return existing.ProxyCluster, nil
 	}
 
-	return existing.ProxyCluster, nil
+	// Falling back to the old cluster here would let an update move a service
+	// onto a domain the account has not validated, bypassing the check that
+	// creation makes.
+	derived, err := m.clusterDeriver.DeriveClusterFromDomain(ctx, accountID, svc.Domain)
+	if err != nil {
+		return "", status.Errorf(status.PreconditionFailed, "could not derive cluster from domain %s: %v", svc.Domain, err)
+	}
+
+	return derived, nil
 }
 
 func (m *Manager) executeServiceUpdate(ctx context.Context, transaction store.Store, accountID string, service *service.Service, updateInfo *serviceUpdateInfo, customPorts *bool, effectiveCluster string) error {
diff --git a/management/internals/server/boot.go b/management/internals/server/boot.go
index 87a36a93b..c28758ab8 100644
--- a/management/internals/server/boot.go
+++ b/management/internals/server/boot.go
@@ -31,6 +31,7 @@ import (
 	rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
 	networkmapdb "github.com/netbirdio/netbird/management/internals/network_map_db"
 	networkmapdbfactory "github.com/netbirdio/netbird/management/internals/network_map_db/factory"
+	nbconfig "github.com/netbirdio/netbird/management/internals/server/config"
 	nbgrpc "github.com/netbirdio/netbird/management/internals/shared/grpc"
 	"github.com/netbirdio/netbird/management/server/activity"
 	activitystore "github.com/netbirdio/netbird/management/server/activity/store"
@@ -111,7 +112,8 @@ func (s *BaseServer) NetworkMapStore() *networkmapdb.NetworkMapDBStoreImpl {
 			s.Config.StoreConfig.Engine,
 			s.Config.Datadir,
 			s.IntegratedValidator(),
-			s.SettingsManager())
+			s.SettingsManager(),
+		)
 		// networkmap db store supports postgres and sqlite backends only
 		// for other backends a fallback is used, so NotSupportedStoreEngineError
 		// is not a fatal error
@@ -180,24 +182,7 @@ func (s *BaseServer) RateLimiter() *middleware.APIRateLimiter {
 
 func (s *BaseServer) GRPCServer() *grpc.Server {
 	return Create(s, func() *grpc.Server {
-		trustedPeers := s.Config.ReverseProxy.TrustedPeers
-		defaultTrustedPeers := []netip.Prefix{netip.MustParsePrefix("0.0.0.0/0"), netip.MustParsePrefix("::/0")}
-		if len(trustedPeers) == 0 || slices.Equal[[]netip.Prefix](trustedPeers, defaultTrustedPeers) {
-			log.WithContext(context.Background()).Warn("TrustedPeers are configured to default value '0.0.0.0/0', '::/0'. This allows connection IP spoofing.")
-			trustedPeers = defaultTrustedPeers
-		}
-		trustedHTTPProxies := s.Config.ReverseProxy.TrustedHTTPProxies
-		trustedProxiesCount := s.Config.ReverseProxy.TrustedHTTPProxiesCount
-		if len(trustedHTTPProxies) > 0 && trustedProxiesCount > 0 {
-			log.WithContext(context.Background()).Warn("TrustedHTTPProxies and TrustedHTTPProxiesCount both are configured. " +
-				"This is not recommended way to extract X-Forwarded-For. Consider using one of these options.")
-		}
-		realipOpts := []realip.Option{
-			realip.WithTrustedPeers(trustedPeers),
-			realip.WithTrustedProxies(trustedHTTPProxies),
-			realip.WithTrustedProxiesCount(trustedProxiesCount),
-			realip.WithHeaders([]string{realip.XForwardedFor, realip.XRealIp}),
-		}
+		realipOpts := realIPOptions(s.Config.ReverseProxy)
 		proxyUnary, proxyStream, proxyAuthClose := nbgrpc.NewProxyAuthInterceptors(s.Store())
 		s.proxyAuthClose = proxyAuthClose
 		gRPCOpts := []grpc.ServerOption{
@@ -333,7 +318,7 @@ func (s *BaseServer) AccessLogsManager() accesslogs.Manager {
 	})
 }
 
-func loadTLSConfig(certFile string, certKey string) (*tls.Config, error) {
+func loadTLSConfig(certFile, certKey string) (*tls.Config, error) {
 	// Load server's certificate and private key
 	serverCert, err := tls.LoadX509KeyPair(certFile, certKey)
 	if err != nil {
@@ -380,3 +365,34 @@ func streamInterceptor(
 	wrapped.WrappedContext = context.WithValue(ctx, nbContext.RequestIDKey, reqID)
 	return handler(srv, wrapped)
 }
+
+// realIPOptions builds the real-IP middleware options from the reverse proxy config.
+//
+// TrustedPeers controls which transport peers are allowed to supply forwarded-IP
+// headers. If empty, forwarded headers are ignored and the transport peer address
+// is used directly. Operators terminating connections at a reverse proxy should
+// configure TrustedPeers with that proxy's address or network.
+//
+// Only X-Forwarded-For is trusted. X-Real-IP contains a single client-supplied
+// address with no proxy chain to validate, and none of the reverse proxies we ship
+// use it on the gRPC path.
+func realIPOptions(cfg nbconfig.ReverseProxy) []realip.Option {
+	if idx := slices.IndexFunc(cfg.TrustedPeers, func(p netip.Prefix) bool { return p.Bits() == 0 }); idx >= 0 {
+		log.WithContext(context.Background()).Warnf("TrustedPeers contains the default route %s, which trusts "+
+			"X-Forwarded-For from every client and allows connection IP spoofing. Set TrustedPeers to the address "+
+			"of your reverse proxy, or leave it empty to use the connection's source address.", cfg.TrustedPeers[idx])
+	}
+	if cfg.TrustedHTTPProxiesCount > 0 {
+		log.WithContext(context.Background()).Warn(
+			"TrustedHTTPProxiesCount skips X-Forwarded-For entries by position before TrustedHTTPProxies filters by address. " +
+				"An incorrect count may skip the real client IP and produce an incorrect source address.",
+		)
+	}
+
+	return []realip.Option{
+		realip.WithTrustedPeers(cfg.TrustedPeers),
+		realip.WithTrustedProxies(cfg.TrustedHTTPProxies),
+		realip.WithTrustedProxiesCount(cfg.TrustedHTTPProxiesCount),
+		realip.WithHeaders([]string{realip.XForwardedFor}),
+	}
+}
diff --git a/management/internals/server/realip_test.go b/management/internals/server/realip_test.go
new file mode 100644
index 000000000..89ac02730
--- /dev/null
+++ b/management/internals/server/realip_test.go
@@ -0,0 +1,171 @@
+package server
+
+import (
+	"context"
+	"io"
+	"net"
+	"net/netip"
+	"testing"
+	"time"
+
+	"github.com/grpc-ecosystem/go-grpc-middleware/v2/interceptors/realip"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+	"google.golang.org/grpc/metadata"
+	"google.golang.org/protobuf/types/known/emptypb"
+
+	nbconfig "github.com/netbirdio/netbird/management/internals/server/config"
+)
+
+const (
+	realIPProbeMethod       = "/netbird.test.RealIPProbe/Probe"
+	realIPProbeStreamMethod = "/netbird.test.RealIPProbe/ProbeStream"
+)
+
+// realIPProbe records the real IP the middleware derived for each call.
+type realIPProbe struct {
+	got chan string
+}
+
+func (p *realIPProbe) record(ctx context.Context) {
+	addr, _ := realip.FromContext(ctx)
+	p.got <- addr.String()
+}
+
+func (p *realIPProbe) wait(t *testing.T) string {
+	t.Helper()
+
+	select {
+	case got := <-p.got:
+		return got
+	case <-time.After(5 * time.Second):
+		t.Fatal("timed out waiting for probe")
+		return ""
+	}
+}
+
+func startProbeServer(t *testing.T, cfg nbconfig.ReverseProxy) (*grpc.ClientConn, *realIPProbe) {
+	t.Helper()
+
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	require.NoError(t, err)
+
+	probe := &realIPProbe{got: make(chan string, 1)}
+	opts := realIPOptions(cfg)
+	srv := grpc.NewServer(
+		grpc.ChainUnaryInterceptor(realip.UnaryServerInterceptorOpts(opts...)),
+		grpc.ChainStreamInterceptor(realip.StreamServerInterceptorOpts(opts...)),
+	)
+	srv.RegisterService(&grpc.ServiceDesc{
+		ServiceName: "netbird.test.RealIPProbe",
+		HandlerType: (*any)(nil),
+		Methods: []grpc.MethodDesc{{
+			MethodName: "Probe",
+			Handler: func(_ any, ctx context.Context, dec func(any) error, interceptor grpc.UnaryServerInterceptor) (any, error) {
+				req := new(emptypb.Empty)
+				if err := dec(req); err != nil {
+					return nil, err
+				}
+				handler := func(ctx context.Context, _ any) (any, error) {
+					probe.record(ctx)
+					return &emptypb.Empty{}, nil
+				}
+				if interceptor == nil {
+					return handler(ctx, req)
+				}
+				return interceptor(ctx, req, &grpc.UnaryServerInfo{FullMethod: realIPProbeMethod}, handler)
+			},
+		}},
+		Streams: []grpc.StreamDesc{{
+			StreamName:    "ProbeStream",
+			ServerStreams: true,
+			Handler: func(_ any, stream grpc.ServerStream) error {
+				probe.record(stream.Context())
+				return nil
+			},
+		}},
+	}, probe)
+
+	go func() { _ = srv.Serve(listener) }()
+	t.Cleanup(srv.Stop)
+
+	conn, err := grpc.NewClient(listener.Addr().String(), grpc.WithTransportCredentials(insecure.NewCredentials()))
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = conn.Close() })
+
+	return conn, probe
+}
+
+func callUnary(t *testing.T, conn *grpc.ClientConn, probe *realIPProbe, kv ...string) string {
+	t.Helper()
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	ctx = metadata.AppendToOutgoingContext(ctx, kv...)
+	require.NoError(t, conn.Invoke(ctx, realIPProbeMethod, &emptypb.Empty{}, &emptypb.Empty{}))
+
+	return probe.wait(t)
+}
+
+func callStream(t *testing.T, conn *grpc.ClientConn, probe *realIPProbe, kv ...string) string {
+	t.Helper()
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	ctx = metadata.AppendToOutgoingContext(ctx, kv...)
+	desc := &grpc.StreamDesc{StreamName: "ProbeStream", ServerStreams: true}
+	stream, err := conn.NewStream(ctx, desc, realIPProbeStreamMethod)
+	require.NoError(t, err)
+	require.NoError(t, stream.CloseSend())
+	require.ErrorIs(t, stream.RecvMsg(&emptypb.Empty{}), io.EOF)
+
+	return probe.wait(t)
+}
+
+func assertRealIP(t *testing.T, cfg nbconfig.ReverseProxy, want string, kv ...string) {
+	t.Helper()
+
+	conn, probe := startProbeServer(t, cfg)
+	t.Run("unary", func(t *testing.T) {
+		assert.Equal(t, want, callUnary(t, conn, probe, kv...))
+	})
+	t.Run("stream", func(t *testing.T) {
+		assert.Equal(t, want, callStream(t, conn, probe, kv...))
+	})
+}
+
+func TestRealIPDefaultIgnoresClientForwardedHeaders(t *testing.T) {
+	assertRealIP(t, nbconfig.ReverseProxy{}, "127.0.0.1",
+		realip.XForwardedFor, "203.0.113.44",
+		realip.XRealIp, "203.0.113.44",
+	)
+}
+
+func TestRealIPUntrustedPeerIgnoresForwardedHeaders(t *testing.T) {
+	cfg := nbconfig.ReverseProxy{TrustedPeers: []netip.Prefix{netip.MustParsePrefix("10.9.8.7/32")}}
+
+	assertRealIP(t, cfg, "127.0.0.1",
+		realip.XForwardedFor, "203.0.113.44",
+		realip.XRealIp, "203.0.113.44",
+	)
+}
+
+func TestRealIPTrustedPeerHonoursForwardedHeaders(t *testing.T) {
+	cfg := nbconfig.ReverseProxy{TrustedPeers: []netip.Prefix{netip.MustParsePrefix("127.0.0.1/32")}}
+
+	assertRealIP(t, cfg, "203.0.113.44",
+		realip.XForwardedFor, "203.0.113.44",
+		realip.XRealIp, "203.0.113.44",
+	)
+}
+
+func TestRealIPIgnoresXRealIPWhenProxyCountIsSet(t *testing.T) {
+	cfg := nbconfig.ReverseProxy{
+		TrustedPeers:            []netip.Prefix{netip.MustParsePrefix("127.0.0.1/32")},
+		TrustedHTTPProxiesCount: 1,
+	}
+
+	assertRealIP(t, cfg, "127.0.0.1", realip.XRealIp, "203.0.113.44")
+}
diff --git a/management/internals/server/server.go b/management/internals/server/server.go
index 22a61bada..a1b58fdf1 100644
--- a/management/internals/server/server.go
+++ b/management/internals/server/server.go
@@ -66,7 +66,8 @@ type BaseServer struct {
 	disableLegacyManagementPort bool
 	autoResolveDomains          bool
 
-	proxyAuthClose func()
+	proxyAuthClose    func()
+	domainCleanupStop func()
 
 	// grpcExtensions holds additional gRPC services, interceptors, and shutdown
 	// hooks registered by external modules via RegisterGRPCExtension. Populated
@@ -74,6 +75,7 @@ type BaseServer struct {
 	grpcExtensions []GRPCExtension
 
 	listener    net.Listener
+	tlsConfig   *tls.Config
 	certManager *autocert.Manager
 	update      *version.Update
 
@@ -94,6 +96,7 @@ type Config struct {
 	DisableGeoliteUpdate        bool
 	UserDeleteFromIDPEnabled    bool
 	AutoResolveDomains          bool
+	TLSConfig                   *tls.Config
 }
 
 // NewServer initializes and configures a new Server instance
@@ -110,6 +113,7 @@ func NewServer(cfg *Config) *BaseServer {
 		disableLegacyManagementPort: cfg.DisableLegacyManagementPort,
 		mgmtMetricsPort:             cfg.MgmtMetricsPort,
 		autoResolveDomains:          cfg.AutoResolveDomains,
+		tlsConfig:                   cfg.TLSConfig,
 	}
 	s.container[ContainerKeyBaseServer] = s
 
@@ -139,21 +143,9 @@ func (s *BaseServer) Start(ctx context.Context) error {
 	}
 	s.EphemeralManager().LoadInitialPeers(srvCtx)
 
-	var tlsConfig *tls.Config
-	tlsEnabled := false
-	if s.Config.HttpConfig.LetsEncryptDomain != "" {
-		s.certManager, err = encryption.CreateCertManager(s.Config.Datadir, s.Config.HttpConfig.LetsEncryptDomain)
-		if err != nil {
-			return fmt.Errorf("failed creating LetsEncrypt cert manager: %v", err)
-		}
-		tlsEnabled = true
-	} else if s.Config.HttpConfig.CertFile != "" && s.Config.HttpConfig.CertKey != "" {
-		tlsConfig, err = loadTLSConfig(s.Config.HttpConfig.CertFile, s.Config.HttpConfig.CertKey)
-		if err != nil {
-			log.WithContext(srvCtx).Errorf("cannot load TLS credentials: %v", err)
-			return err
-		}
-		tlsEnabled = true
+	tlsEnabled, err := s.setupTLS(srvCtx)
+	if err != nil {
+		return err
 	}
 
 	installationID, err := getInstallationID(srvCtx, s.Store())
@@ -215,8 +207,8 @@ func (s *BaseServer) Start(ctx context.Context) error {
 			log.WithContext(ctx).Infof("running HTTP server (LetsEncrypt challenge handler): %s", cml.Addr().String())
 			s.serveHTTP(ctx, cml, s.certManager.HTTPHandler(nil))
 		}
-	case tlsConfig != nil:
-		s.listener, err = tls.Listen("tcp", fmt.Sprintf(":%d", s.mgmtPort), tlsConfig)
+	case s.tlsConfig != nil:
+		s.listener, err = tls.Listen("tcp", fmt.Sprintf(":%d", s.mgmtPort), s.tlsConfig)
 		if err != nil {
 			return fmt.Errorf("failed creating TLS listener on port %d: %v", s.mgmtPort, err)
 		}
@@ -236,14 +228,59 @@ func (s *BaseServer) Start(ctx context.Context) error {
 	s.update.SetOnUpdateListener(func() {
 		log.WithContext(ctx).Infof("your management version, \"%s\", is outdated, a new management version is available. Learn more here: https://github.com/netbirdio/netbird/releases", version.NetbirdVersion())
 	})
+	s.startDomainCleanup(srvCtx)
 
 	return nil
 }
+func (s *BaseServer) startDomainCleanup(ctx context.Context) {
+	if s.domainCleanupStop != nil {
+		return
+	}
+	mgr := s.ReverseProxyDomainManager()
+	ctx, cancel := context.WithCancel(ctx)
+	done := make(chan struct{})
+	s.domainCleanupStop = func() {
+		cancel()
+		<-done
+	}
+	go func() {
+		defer close(done)
+		mgr.RunValidationCleanup(ctx)
+	}()
+}
+
+// setupTLS resolves the listener's TLS source: an injected config wins over the HttpConfig certificate settings
+func (s *BaseServer) setupTLS(ctx context.Context) (bool, error) {
+	switch {
+	case s.tlsConfig != nil:
+		return true, nil
+	case s.Config.HttpConfig.LetsEncryptDomain != "":
+		certManager, err := encryption.CreateCertManager(s.Config.Datadir, s.Config.HttpConfig.LetsEncryptDomain)
+		if err != nil {
+			return false, fmt.Errorf("failed creating LetsEncrypt cert manager: %v", err)
+		}
+		s.certManager = certManager
+		return true, nil
+	case s.Config.HttpConfig.CertFile != "" && s.Config.HttpConfig.CertKey != "":
+		tlsConfig, err := loadTLSConfig(s.Config.HttpConfig.CertFile, s.Config.HttpConfig.CertKey)
+		if err != nil {
+			log.WithContext(ctx).Errorf("cannot load TLS credentials: %v", err)
+			return false, err
+		}
+		s.tlsConfig = tlsConfig
+		return true, nil
+	default:
+		return false, nil
+	}
+}
 
 // Stop attempts a graceful shutdown, waiting up to 5 seconds for active connections to finish
 func (s *BaseServer) Stop() error {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
+	if s.domainCleanupStop != nil {
+		s.domainCleanupStop()
+	}
 
 	s.IntegratedValidator().Stop(ctx)
 	if s.GeoLocationManager() != nil {
diff --git a/management/internals/shared/grpc/peer_update_handler.go b/management/internals/shared/grpc/peer_update_handler.go
new file mode 100644
index 000000000..d2f403841
--- /dev/null
+++ b/management/internals/shared/grpc/peer_update_handler.go
@@ -0,0 +1,135 @@
+package grpc
+
+import (
+	"context"
+	"time"
+
+	"github.com/netbirdio/netbird/encryption"
+	"github.com/netbirdio/netbird/management/internals/controllers/network_map"
+	"github.com/netbirdio/netbird/management/server/telemetry"
+	"github.com/netbirdio/netbird/shared/management/proto"
+	log "github.com/sirupsen/logrus"
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+)
+
+func PeerUpdateHandlerFactory(
+	peerKey wgtypes.Key,
+	updates chan *network_map.UpdateMessage,
+	secretsManager SecretsManager,
+	srv proto.ManagementService_SyncServer,
+	cleanupfunc func()) *PeerUpdateHandler {
+	return &PeerUpdateHandler{
+		peerKey:        peerKey,
+		updates:        updates,
+		secretsManager: secretsManager,
+		srv:            srv,
+		encrypter:      encryption.DefaultEncrypter{},
+		debouncer:      NewUpdateDebouncer(1000 * time.Millisecond),
+		cleanupFunc:    cleanupfunc,
+	}
+}
+
+// PeerUpdateHandler sends updates to the connected peer until the updates channel is closed.
+// It implements a backpressure mechanism that sends the first update immediately,
+// then debounces subsequent rapid updates, ensuring only the latest update is sent
+// after a quiet period.
+type PeerUpdateHandler struct {
+	peerKey        wgtypes.Key
+	updates        chan *network_map.UpdateMessage
+	appMetrics     telemetry.AppMetrics
+	secretsManager SecretsManager
+	srv            syncSender
+	encrypter      encryption.Encrypter
+	debouncer      Debouncer
+	cleanupFunc    func()
+}
+
+func (pu *PeerUpdateHandler) WithMetrics(appMetrics telemetry.AppMetrics) *PeerUpdateHandler {
+	pu.appMetrics = appMetrics
+	return pu
+}
+
+//go:generate go tool mockgen -source=./peer_update_handler.go -destination=./sync_sender_mock.go -package=grpc
+type syncSender interface {
+	Send(*proto.EncryptedMessage) error
+	Context() context.Context
+}
+
+func (pu *PeerUpdateHandler) HandleUpdates(ctx context.Context) error {
+	log.WithContext(ctx).Tracef("starting to handle updates for peer %s", pu.peerKey.String())
+
+	defer pu.debouncer.Stop()
+
+	for {
+		select {
+		// condition when there are some updates
+		// todo set the updates channel size to 1
+		case update, open := <-pu.updates:
+			if pu.appMetrics != nil {
+				pu.appMetrics.GRPCMetrics().UpdateChannelQueueLength(len(pu.updates) + 1)
+			}
+
+			if !open {
+				log.WithContext(ctx).Debugf("updates channel for peer %s was closed", pu.peerKey.String())
+				pu.cleanupFunc()
+				return nil
+			}
+
+			log.WithContext(ctx).Tracef("received an update for peer %s", pu.peerKey.String())
+			if pu.debouncer.ProcessUpdate(update) {
+				// Send immediately (first update or after quiet period)
+				if err := pu.SendUpdate(ctx, update); err != nil {
+					log.WithContext(ctx).Debugf("error while sending an update to peer %s: %v", pu.peerKey.String(), err)
+					return err
+				}
+			}
+
+		// Timer expired - quiet period reached, send pending updates if any
+		case <-pu.debouncer.TimerChannel():
+			pendingUpdates := pu.debouncer.GetPendingUpdates()
+			if len(pendingUpdates) == 0 {
+				continue
+			}
+			log.WithContext(ctx).Debugf("sending %d debounced update(s) for peer %s", len(pendingUpdates), pu.peerKey.String())
+			for _, pendingUpdate := range pendingUpdates {
+				if err := pu.SendUpdate(ctx, pendingUpdate); err != nil {
+					log.WithContext(ctx).Debugf("error while sending an update to peer %s: %v", pu.peerKey.String(), err)
+					return err
+				}
+			}
+
+		// condition when client <-> server connection has been terminated
+		case <-pu.srv.Context().Done():
+			// happens when connection drops, e.g. client disconnects
+			log.WithContext(ctx).Debugf("stream of peer %s has been closed", pu.peerKey.String())
+			pu.cleanupFunc()
+			return pu.srv.Context().Err()
+		}
+	}
+}
+
+func (pu *PeerUpdateHandler) SendUpdate(ctx context.Context, update *network_map.UpdateMessage) error {
+	key, err := pu.secretsManager.GetWGKey()
+	if err != nil {
+		pu.cleanupFunc()
+		return status.Errorf(codes.Internal, "failed processing update message")
+	}
+
+	encryptedResp, err := pu.encrypter.EncryptMessage(pu.peerKey, key, update.Update)
+	if err != nil {
+		pu.cleanupFunc()
+		return status.Errorf(codes.Internal, "failed processing update message")
+	}
+	err = pu.srv.Send(&proto.EncryptedMessage{
+		WgPubKey: key.PublicKey().String(),
+		Body:     encryptedResp,
+	})
+	if err != nil {
+		pu.cleanupFunc()
+		return status.Errorf(codes.Internal, "failed sending update message")
+	}
+	log.WithContext(ctx).Tracef("sent an update to peer %s", pu.peerKey.String())
+	return nil
+}
diff --git a/management/internals/shared/grpc/peer_update_handler_test.go b/management/internals/shared/grpc/peer_update_handler_test.go
new file mode 100644
index 000000000..02de49c47
--- /dev/null
+++ b/management/internals/shared/grpc/peer_update_handler_test.go
@@ -0,0 +1,155 @@
+package grpc
+
+import (
+	"context"
+	"fmt"
+	"sync"
+	"testing"
+	"time"
+
+	pb "github.com/golang/protobuf/proto" //nolint
+	"github.com/netbirdio/netbird/management/internals/controllers/network_map"
+	"github.com/netbirdio/netbird/shared/management/proto"
+	"github.com/stretchr/testify/assert"
+	"go.uber.org/mock/gomock"
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
+)
+
+func TestSendPeerUpdates_FirstUpdate(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	secretsManager := NewMockSecretsManager(ctrl)
+	updateDebouncer := NewMockDebouncer(ctrl)
+	syncSender := NewMocksyncSender(ctrl)
+
+	pu := PeerUpdateHandler{
+		peerKey:        mustGenerateKey(t),
+		updates:        make(chan *network_map.UpdateMessage),
+		secretsManager: secretsManager,
+		encrypter:      testEncrypter{},
+		debouncer:      updateDebouncer,
+		srv:            syncSender,
+		cleanupFunc:    func() {},
+	}
+
+	msg := network_map.UpdateMessage{
+		Update: &proto.SyncResponse{Version: 1},
+	}
+
+	timeCh := make(chan time.Time)
+	srvCtx := context.TODO()
+	srvKey := mustGenerateKey(t)
+	// mock a first update, should send it right away
+	updateDebouncer.EXPECT().ProcessUpdate(gomock.Eq(&msg)).Return(true)
+	updateDebouncer.EXPECT().TimerChannel().AnyTimes().Return(timeCh)
+	syncSender.EXPECT().Context().AnyTimes().Return(srvCtx)
+	secretsManager.EXPECT().GetWGKey().Return(srvKey, nil)
+	syncSender.EXPECT().Send(pbMatcher{x: &proto.EncryptedMessage{WgPubKey: srvKey.PublicKey().String(), Body: mustMarshal(t, &msg)}})
+	updateDebouncer.EXPECT().Stop()
+
+	var wg sync.WaitGroup
+	wg.Go(func() { pu.HandleUpdates(context.TODO()) }) //nolint:errcheck
+	pu.updates <- &msg
+	close(pu.updates)
+	wg.Wait()
+}
+
+func TestSendPeerUpdates_TimerUpdate(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	secretsManager := NewMockSecretsManager(ctrl)
+	updateDebouncer := NewMockDebouncer(ctrl)
+	syncSender := NewMocksyncSender(ctrl)
+
+	pu := PeerUpdateHandler{
+		peerKey:        mustGenerateKey(t),
+		updates:        make(chan *network_map.UpdateMessage),
+		secretsManager: secretsManager,
+		encrypter:      testEncrypter{},
+		debouncer:      updateDebouncer,
+		srv:            syncSender,
+		cleanupFunc:    func() {},
+	}
+
+	msg := network_map.UpdateMessage{
+		Update: &proto.SyncResponse{Version: 1},
+	}
+
+	timeCh := make(chan time.Time)
+	srvCtx := context.TODO()
+	srvKey := mustGenerateKey(t)
+	updateDebouncer.EXPECT().GetPendingUpdates().Return([]*network_map.UpdateMessage{&msg})
+	updateDebouncer.EXPECT().TimerChannel().AnyTimes().Return(timeCh)
+	syncSender.EXPECT().Context().AnyTimes().Return(srvCtx)
+	secretsManager.EXPECT().GetWGKey().Return(srvKey, nil)
+	syncSender.EXPECT().Send(pbMatcher{x: &proto.EncryptedMessage{WgPubKey: srvKey.PublicKey().String(), Body: mustMarshal(t, &msg)}})
+	updateDebouncer.EXPECT().Stop()
+
+	var wg sync.WaitGroup
+	wg.Go(func() { pu.HandleUpdates(context.TODO()) }) //nolint:errcheck
+	timeCh <- time.Now()
+	close(pu.updates)
+	wg.Wait()
+}
+
+func TestSendPeerUpdates_ServerContextDone(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	secretsManager := NewMockSecretsManager(ctrl)
+	updateDebouncer := NewMockDebouncer(ctrl)
+	syncSender := NewMocksyncSender(ctrl)
+
+	pu := PeerUpdateHandler{
+		peerKey:        mustGenerateKey(t),
+		updates:        make(chan *network_map.UpdateMessage),
+		secretsManager: secretsManager,
+		encrypter:      testEncrypter{},
+		debouncer:      updateDebouncer,
+		srv:            syncSender,
+		cleanupFunc:    func() {},
+	}
+
+	timeCh := make(chan time.Time)
+	srvCtx, cancel := context.WithCancel(context.TODO())
+	updateDebouncer.EXPECT().TimerChannel().AnyTimes().Return(timeCh)
+	syncSender.EXPECT().Context().AnyTimes().Return(srvCtx)
+	updateDebouncer.EXPECT().Stop()
+
+	var wg sync.WaitGroup
+	wg.Go(func() { pu.HandleUpdates(context.TODO()) }) //nolint:errcheck
+	cancel()
+	wg.Wait()
+}
+
+func mustGenerateKey(t *testing.T) wgtypes.Key {
+	t.Helper()
+	k, err := wgtypes.GenerateKey()
+	assert.NoError(t, err)
+	return k
+}
+
+func mustMarshal(t *testing.T, msg *network_map.UpdateMessage) []byte {
+	t.Helper()
+	r, err := pb.Marshal(msg.Update)
+	assert.NoError(t, err)
+	return r
+}
+
+type testEncrypter struct{}
+
+func (testEncrypter) EncryptMessage(remotePubKey wgtypes.Key, ourPrivateKey wgtypes.Key, message pb.Message) ([]byte, error) {
+	return pb.Marshal(message)
+}
+
+type pbMatcher struct {
+	x pb.Message
+}
+
+func (pbm pbMatcher) Matches(x any) bool {
+	msg, ok := x.(pb.Message)
+	if !ok {
+		return false
+	}
+	return pb.Equal(pbm.x, msg)
+}
+
+func (pbm pbMatcher) String() string {
+	return fmt.Sprintf("is equal to %s (%T)", pbm.x, pbm.x)
+}
diff --git a/management/internals/shared/grpc/server.go b/management/internals/shared/grpc/server.go
index a9cc0ad36..c178b6fa1 100644
--- a/management/internals/shared/grpc/server.go
+++ b/management/internals/shared/grpc/server.go
@@ -337,7 +337,8 @@ func (s *Server) Sync(req *proto.EncryptedMessage, srv proto.ManagementService_S
 
 	s.syncSem.Add(-1)
 
-	return s.handleUpdates(ctx, accountID, peerKey, peer, updates, srv, syncStart)
+	return PeerUpdateHandlerFactory(peerKey, updates, s.secretsManager, srv, func() { s.cancelPeerRoutines(ctx, accountID, peer, syncStart) }).
+		WithMetrics(s.appMetrics).HandleUpdates(ctx)
 }
 
 func (s *Server) handleHandshake(ctx context.Context, srv proto.ManagementService_JobServer) (wgtypes.Key, error) {
@@ -404,91 +405,6 @@ func (s *Server) sendJobsLoop(ctx context.Context, accountID string, peerKey wgt
 	}
 }
 
-// handleUpdates sends updates to the connected peer until the updates channel is closed.
-// It implements a backpressure mechanism that sends the first update immediately,
-// then debounces subsequent rapid updates, ensuring only the latest update is sent
-// after a quiet period.
-func (s *Server) handleUpdates(ctx context.Context, accountID string, peerKey wgtypes.Key, peer *nbpeer.Peer, updates chan *network_map.UpdateMessage, srv proto.ManagementService_SyncServer, streamStartTime time.Time) error {
-	log.WithContext(ctx).Tracef("starting to handle updates for peer %s", peerKey.String())
-
-	// Create a debouncer for this peer connection
-	debouncer := NewUpdateDebouncer(1000 * time.Millisecond)
-	defer debouncer.Stop()
-
-	for {
-		select {
-		// condition when there are some updates
-		// todo set the updates channel size to 1
-		case update, open := <-updates:
-			if s.appMetrics != nil {
-				s.appMetrics.GRPCMetrics().UpdateChannelQueueLength(len(updates) + 1)
-			}
-
-			if !open {
-				log.WithContext(ctx).Debugf("updates channel for peer %s was closed", peerKey.String())
-				s.cancelPeerRoutines(ctx, accountID, peer, streamStartTime)
-				return nil
-			}
-
-			log.WithContext(ctx).Tracef("received an update for peer %s", peerKey.String())
-			if debouncer.ProcessUpdate(update) {
-				// Send immediately (first update or after quiet period)
-				if err := s.sendUpdate(ctx, accountID, peerKey, peer, update, srv, streamStartTime); err != nil {
-					log.WithContext(ctx).Debugf("error while sending an update to peer %s: %v", peerKey.String(), err)
-					return err
-				}
-			}
-
-		// Timer expired - quiet period reached, send pending updates if any
-		case <-debouncer.TimerChannel():
-			pendingUpdates := debouncer.GetPendingUpdates()
-			if len(pendingUpdates) == 0 {
-				continue
-			}
-			log.WithContext(ctx).Debugf("sending %d debounced update(s) for peer %s", len(pendingUpdates), peerKey.String())
-			for _, pendingUpdate := range pendingUpdates {
-				if err := s.sendUpdate(ctx, accountID, peerKey, peer, pendingUpdate, srv, streamStartTime); err != nil {
-					log.WithContext(ctx).Debugf("error while sending an update to peer %s: %v", peerKey.String(), err)
-					return err
-				}
-			}
-
-		// condition when client <-> server connection has been terminated
-		case <-srv.Context().Done():
-			// happens when connection drops, e.g. client disconnects
-			log.WithContext(ctx).Debugf("stream of peer %s has been closed", peerKey.String())
-			s.cancelPeerRoutines(ctx, accountID, peer, streamStartTime)
-			return srv.Context().Err()
-		}
-	}
-}
-
-// sendUpdate encrypts the update message using the peer key and the server's wireguard key,
-// then sends the encrypted message to the connected peer via the sync server.
-func (s *Server) sendUpdate(ctx context.Context, accountID string, peerKey wgtypes.Key, peer *nbpeer.Peer, update *network_map.UpdateMessage, srv proto.ManagementService_SyncServer, streamStartTime time.Time) error {
-	key, err := s.secretsManager.GetWGKey()
-	if err != nil {
-		s.cancelPeerRoutines(ctx, accountID, peer, streamStartTime)
-		return status.Errorf(codes.Internal, "failed processing update message")
-	}
-
-	encryptedResp, err := encryption.EncryptMessage(peerKey, key, update.Update)
-	if err != nil {
-		s.cancelPeerRoutines(ctx, accountID, peer, streamStartTime)
-		return status.Errorf(codes.Internal, "failed processing update message")
-	}
-	err = srv.Send(&proto.EncryptedMessage{
-		WgPubKey: key.PublicKey().String(),
-		Body:     encryptedResp,
-	})
-	if err != nil {
-		s.cancelPeerRoutines(ctx, accountID, peer, streamStartTime)
-		return status.Errorf(codes.Internal, "failed sending update message")
-	}
-	log.WithContext(ctx).Tracef("sent an update to peer %s", peerKey.String())
-	return nil
-}
-
 // sendJob encrypts the update message using the peer key and the server's wireguard key,
 // then sends the encrypted message to the connected peer via the sync server.
 func (s *Server) sendJob(ctx context.Context, peerKey wgtypes.Key, job *job.Event, srv proto.ManagementService_JobServer) error {
diff --git a/management/internals/shared/grpc/sync_sender_mock.go b/management/internals/shared/grpc/sync_sender_mock.go
new file mode 100644
index 000000000..3d1696f59
--- /dev/null
+++ b/management/internals/shared/grpc/sync_sender_mock.go
@@ -0,0 +1,70 @@
+// Code generated by MockGen. DO NOT EDIT.
+// Source: ./peer_update_handler.go
+//
+// Generated by this command:
+//
+//	mockgen -source=./peer_update_handler.go -destination=./sync_sender_mock.go -package=grpc
+//
+
+// Package grpc is a generated GoMock package.
+package grpc
+
+import (
+	context "context"
+	reflect "reflect"
+
+	proto "github.com/netbirdio/netbird/shared/management/proto"
+	gomock "go.uber.org/mock/gomock"
+)
+
+// MocksyncSender is a mock of syncSender interface.
+type MocksyncSender struct {
+	ctrl     *gomock.Controller
+	recorder *MocksyncSenderMockRecorder
+	isgomock struct{}
+}
+
+// MocksyncSenderMockRecorder is the mock recorder for MocksyncSender.
+type MocksyncSenderMockRecorder struct {
+	mock *MocksyncSender
+}
+
+// NewMocksyncSender creates a new mock instance.
+func NewMocksyncSender(ctrl *gomock.Controller) *MocksyncSender {
+	mock := &MocksyncSender{ctrl: ctrl}
+	mock.recorder = &MocksyncSenderMockRecorder{mock}
+	return mock
+}
+
+// EXPECT returns an object that allows the caller to indicate expected use.
+func (m *MocksyncSender) EXPECT() *MocksyncSenderMockRecorder {
+	return m.recorder
+}
+
+// Context mocks base method.
+func (m *MocksyncSender) Context() context.Context {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "Context")
+	ret0, _ := ret[0].(context.Context)
+	return ret0
+}
+
+// Context indicates an expected call of Context.
+func (mr *MocksyncSenderMockRecorder) Context() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Context", reflect.TypeOf((*MocksyncSender)(nil).Context))
+}
+
+// Send mocks base method.
+func (m *MocksyncSender) Send(arg0 *proto.EncryptedMessage) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "Send", arg0)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// Send indicates an expected call of Send.
+func (mr *MocksyncSenderMockRecorder) Send(arg0 any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Send", reflect.TypeOf((*MocksyncSender)(nil).Send), arg0)
+}
diff --git a/management/internals/shared/grpc/token_mgr.go b/management/internals/shared/grpc/token_mgr.go
index fb2d83a9a..4dab5007f 100644
--- a/management/internals/shared/grpc/token_mgr.go
+++ b/management/internals/shared/grpc/token_mgr.go
@@ -25,6 +25,8 @@ import (
 const defaultDuration = 12 * time.Hour
 
 // SecretsManager used to manage TURN and relay secrets
+//
+//go:generate go tool mockgen -source=./token_mgr.go -destination=./token_mgr_mock.go -package=grpc
 type SecretsManager interface {
 	GenerateTurnToken() (*Token, error)
 	GenerateRelayToken() (*Token, error)
diff --git a/management/internals/shared/grpc/token_mgr_mock.go b/management/internals/shared/grpc/token_mgr_mock.go
new file mode 100644
index 000000000..e7dde4e3a
--- /dev/null
+++ b/management/internals/shared/grpc/token_mgr_mock.go
@@ -0,0 +1,111 @@
+// Code generated by MockGen. DO NOT EDIT.
+// Source: ./token_mgr.go
+//
+// Generated by this command:
+//
+//	mockgen -source=./token_mgr.go -destination=./token_mgr_mock.go -package=grpc
+//
+
+// Package grpc is a generated GoMock package.
+package grpc
+
+import (
+	context "context"
+	reflect "reflect"
+
+	gomock "go.uber.org/mock/gomock"
+	wgtypes "golang.zx2c4.com/wireguard/wgctrl/wgtypes"
+)
+
+// MockSecretsManager is a mock of SecretsManager interface.
+type MockSecretsManager struct {
+	ctrl     *gomock.Controller
+	recorder *MockSecretsManagerMockRecorder
+	isgomock struct{}
+}
+
+// MockSecretsManagerMockRecorder is the mock recorder for MockSecretsManager.
+type MockSecretsManagerMockRecorder struct {
+	mock *MockSecretsManager
+}
+
+// NewMockSecretsManager creates a new mock instance.
+func NewMockSecretsManager(ctrl *gomock.Controller) *MockSecretsManager {
+	mock := &MockSecretsManager{ctrl: ctrl}
+	mock.recorder = &MockSecretsManagerMockRecorder{mock}
+	return mock
+}
+
+// EXPECT returns an object that allows the caller to indicate expected use.
+func (m *MockSecretsManager) EXPECT() *MockSecretsManagerMockRecorder {
+	return m.recorder
+}
+
+// CancelRefresh mocks base method.
+func (m *MockSecretsManager) CancelRefresh(peerKey string) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "CancelRefresh", peerKey)
+}
+
+// CancelRefresh indicates an expected call of CancelRefresh.
+func (mr *MockSecretsManagerMockRecorder) CancelRefresh(peerKey any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CancelRefresh", reflect.TypeOf((*MockSecretsManager)(nil).CancelRefresh), peerKey)
+}
+
+// GenerateRelayToken mocks base method.
+func (m *MockSecretsManager) GenerateRelayToken() (*Token, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GenerateRelayToken")
+	ret0, _ := ret[0].(*Token)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GenerateRelayToken indicates an expected call of GenerateRelayToken.
+func (mr *MockSecretsManagerMockRecorder) GenerateRelayToken() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GenerateRelayToken", reflect.TypeOf((*MockSecretsManager)(nil).GenerateRelayToken))
+}
+
+// GenerateTurnToken mocks base method.
+func (m *MockSecretsManager) GenerateTurnToken() (*Token, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GenerateTurnToken")
+	ret0, _ := ret[0].(*Token)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GenerateTurnToken indicates an expected call of GenerateTurnToken.
+func (mr *MockSecretsManagerMockRecorder) GenerateTurnToken() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GenerateTurnToken", reflect.TypeOf((*MockSecretsManager)(nil).GenerateTurnToken))
+}
+
+// GetWGKey mocks base method.
+func (m *MockSecretsManager) GetWGKey() (wgtypes.Key, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetWGKey")
+	ret0, _ := ret[0].(wgtypes.Key)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetWGKey indicates an expected call of GetWGKey.
+func (mr *MockSecretsManagerMockRecorder) GetWGKey() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetWGKey", reflect.TypeOf((*MockSecretsManager)(nil).GetWGKey))
+}
+
+// SetupRefresh mocks base method.
+func (m *MockSecretsManager) SetupRefresh(ctx context.Context, accountID, peerKey string) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "SetupRefresh", ctx, accountID, peerKey)
+}
+
+// SetupRefresh indicates an expected call of SetupRefresh.
+func (mr *MockSecretsManagerMockRecorder) SetupRefresh(ctx, accountID, peerKey any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SetupRefresh", reflect.TypeOf((*MockSecretsManager)(nil).SetupRefresh), ctx, accountID, peerKey)
+}
diff --git a/management/internals/shared/grpc/update_debouncer.go b/management/internals/shared/grpc/update_debouncer.go
index 8af9c2656..9483007c6 100644
--- a/management/internals/shared/grpc/update_debouncer.go
+++ b/management/internals/shared/grpc/update_debouncer.go
@@ -6,6 +6,14 @@ import (
 	"github.com/netbirdio/netbird/management/internals/controllers/network_map"
 )
 
+//go:generate go tool mockgen -source=./update_debouncer.go -destination=./update_debouncer_mock.go -package=grpc
+type Debouncer interface {
+	Stop()
+	TimerChannel() <-chan time.Time
+	ProcessUpdate(update *network_map.UpdateMessage) bool
+	GetPendingUpdates() []*network_map.UpdateMessage
+}
+
 // UpdateDebouncer implements a backpressure mechanism that:
 // - Sends the first update immediately
 // - Coalesces rapid subsequent network map updates (only latest matters)
diff --git a/management/internals/shared/grpc/update_debouncer_mock.go b/management/internals/shared/grpc/update_debouncer_mock.go
new file mode 100644
index 000000000..4dff632b7
--- /dev/null
+++ b/management/internals/shared/grpc/update_debouncer_mock.go
@@ -0,0 +1,96 @@
+// Code generated by MockGen. DO NOT EDIT.
+// Source: ./update_debouncer.go
+//
+// Generated by this command:
+//
+//	mockgen -source=./update_debouncer.go -destination=./update_debouncer_mock.go -package=grpc
+//
+
+// Package grpc is a generated GoMock package.
+package grpc
+
+import (
+	reflect "reflect"
+	time "time"
+
+	network_map "github.com/netbirdio/netbird/management/internals/controllers/network_map"
+	gomock "go.uber.org/mock/gomock"
+)
+
+// MockDebouncer is a mock of Debouncer interface.
+type MockDebouncer struct {
+	ctrl     *gomock.Controller
+	recorder *MockDebouncerMockRecorder
+	isgomock struct{}
+}
+
+// MockDebouncerMockRecorder is the mock recorder for MockDebouncer.
+type MockDebouncerMockRecorder struct {
+	mock *MockDebouncer
+}
+
+// NewMockDebouncer creates a new mock instance.
+func NewMockDebouncer(ctrl *gomock.Controller) *MockDebouncer {
+	mock := &MockDebouncer{ctrl: ctrl}
+	mock.recorder = &MockDebouncerMockRecorder{mock}
+	return mock
+}
+
+// EXPECT returns an object that allows the caller to indicate expected use.
+func (m *MockDebouncer) EXPECT() *MockDebouncerMockRecorder {
+	return m.recorder
+}
+
+// GetPendingUpdates mocks base method.
+func (m *MockDebouncer) GetPendingUpdates() []*network_map.UpdateMessage {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetPendingUpdates")
+	ret0, _ := ret[0].([]*network_map.UpdateMessage)
+	return ret0
+}
+
+// GetPendingUpdates indicates an expected call of GetPendingUpdates.
+func (mr *MockDebouncerMockRecorder) GetPendingUpdates() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetPendingUpdates", reflect.TypeOf((*MockDebouncer)(nil).GetPendingUpdates))
+}
+
+// ProcessUpdate mocks base method.
+func (m *MockDebouncer) ProcessUpdate(update *network_map.UpdateMessage) bool {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "ProcessUpdate", update)
+	ret0, _ := ret[0].(bool)
+	return ret0
+}
+
+// ProcessUpdate indicates an expected call of ProcessUpdate.
+func (mr *MockDebouncerMockRecorder) ProcessUpdate(update any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ProcessUpdate", reflect.TypeOf((*MockDebouncer)(nil).ProcessUpdate), update)
+}
+
+// Stop mocks base method.
+func (m *MockDebouncer) Stop() {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "Stop")
+}
+
+// Stop indicates an expected call of Stop.
+func (mr *MockDebouncerMockRecorder) Stop() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Stop", reflect.TypeOf((*MockDebouncer)(nil).Stop))
+}
+
+// TimerChannel mocks base method.
+func (m *MockDebouncer) TimerChannel() <-chan time.Time {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "TimerChannel")
+	ret0, _ := ret[0].(<-chan time.Time)
+	return ret0
+}
+
+// TimerChannel indicates an expected call of TimerChannel.
+func (mr *MockDebouncerMockRecorder) TimerChannel() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "TimerChannel", reflect.TypeOf((*MockDebouncer)(nil).TimerChannel))
+}
diff --git a/management/server/account.go b/management/server/account.go
index 3ceef79db..6ccf673f5 100644
--- a/management/server/account.go
+++ b/management/server/account.go
@@ -719,8 +719,10 @@ func (am *DefaultAccountManager) schedulePeerLoginExpiration(ctx context.Context
 		log.WithContext(ctx).Tracef("peer login expiration job for account %s is already scheduled", accountID)
 		return
 	}
+	// The job outlives the request that arms it, so it must not inherit the request's cancellation.
+	jobCtx := context.WithoutCancel(ctx)
 	if nextRun, ok := am.getNextPeerExpiration(ctx, accountID); ok {
-		go am.peerLoginExpiry.Schedule(ctx, nextRun, accountID, am.peerLoginExpirationJob(ctx, accountID))
+		go am.peerLoginExpiry.Schedule(jobCtx, nextRun, accountID, am.peerLoginExpirationJob(jobCtx, accountID))
 	}
 }
 
@@ -752,8 +754,9 @@ func (am *DefaultAccountManager) peerInactivityExpirationJob(ctx context.Context
 // checkAndSchedulePeerInactivityExpiration periodically checks for inactive peers to end their sessions
 func (am *DefaultAccountManager) checkAndSchedulePeerInactivityExpiration(ctx context.Context, accountID string) {
 	am.peerInactivityExpiry.Cancel(ctx, []string{accountID})
+	jobCtx := context.WithoutCancel(ctx)
 	if nextRun, ok := am.getNextInactivePeerExpiration(ctx, accountID); ok {
-		go am.peerInactivityExpiry.Schedule(ctx, nextRun, accountID, am.peerInactivityExpirationJob(ctx, accountID))
+		go am.peerInactivityExpiry.Schedule(jobCtx, nextRun, accountID, am.peerInactivityExpirationJob(jobCtx, accountID))
 	}
 }
 
diff --git a/management/server/account_test.go b/management/server/account_test.go
index b462cc2a6..bd7bf2d97 100644
--- a/management/server/account_test.go
+++ b/management/server/account_test.go
@@ -1920,6 +1920,154 @@ func TestDefaultAccountManager_MarkPeerConnected_PeerLoginExpiration(t *testing.
 	}
 }
 
+func TestDefaultAccountManager_SchedulePeerLoginExpiration_IncludesOfflinePeers(t *testing.T) {
+	manager, updateManager, err := createManager(t)
+	require.NoError(t, err, "unable to create account manager")
+
+	accountID, err := manager.GetAccountIDByUserID(context.Background(), auth.UserAuth{UserId: userID})
+	require.NoError(t, err, "unable to create an account")
+
+	connectedKey, offlineKey := addExpiringPeers(t, manager)
+	_, err = manager.UpdateAccountSettings(context.Background(), accountID, userID, &types.Settings{
+		PeerLoginExpiration:        time.Hour,
+		PeerLoginExpirationEnabled: true,
+		Extra:                      &types.ExtraSettings{},
+	})
+	require.NoError(t, err, "expecting to update account settings successfully but got error")
+	manager.peerLoginExpiry.CancelAll(context.Background())
+
+	// The connected peer logged in just now, so a job computed from connected peers alone
+	// would be armed for an hour. The offline peer's login expires in two seconds; a
+	// reconnect of that peer must not have to wait for the connected peer's tick.
+	now := time.Now().UTC()
+	setPeerLogin(t, manager, accountID, connectedKey, true, now)
+	setPeerLogin(t, manager, accountID, offlineKey, false, now.Add(-time.Hour+2*time.Second))
+
+	offlinePeer, err := manager.Store.GetPeerByPeerPubKey(context.Background(), store.LockingStrengthNone, offlineKey)
+	require.NoError(t, err)
+	updateManager.CreateChannel(context.Background(), offlinePeer.ID)
+
+	manager.peerLoginExpiry = NewDefaultScheduler()
+	t.Cleanup(func() { manager.peerLoginExpiry.CancelAll(context.Background()) })
+	manager.schedulePeerLoginExpiration(context.Background(), accountID)
+
+	// The flag is committed per peer before the disconnect fans out, so wait for both.
+	require.Eventually(t, func() bool {
+		peer, err := manager.Store.GetPeerByPeerPubKey(context.Background(), store.LockingStrengthNone, offlineKey)
+		return err == nil && peer.Status.LoginExpired && !updateManager.HasChannel(offlinePeer.ID)
+	}, 10*time.Second, 100*time.Millisecond, "offline peer should be expired and disconnected at its own deadline")
+
+	connectedPeer, err := manager.Store.GetPeerByPeerPubKey(context.Background(), store.LockingStrengthNone, connectedKey)
+	require.NoError(t, err)
+	assert.False(t, connectedPeer.Status.LoginExpired, "connected peer with a fresh login must not expire")
+}
+
+func TestDefaultAccountManager_SchedulePeerLoginExpiration_DetachesRequestContext(t *testing.T) {
+	manager, _, err := createManager(t)
+	require.NoError(t, err, "unable to create account manager")
+
+	accountID, err := manager.GetAccountIDByUserID(context.Background(), auth.UserAuth{UserId: userID})
+	require.NoError(t, err, "unable to create an account")
+	connectedKey, _ := addExpiringPeers(t, manager)
+	setPeerLogin(t, manager, accountID, connectedKey, true, time.Now().UTC())
+
+	scheduled := make(chan context.Context, 1)
+	manager.peerLoginExpiry = &MockScheduler{
+		IsSchedulerRunningFunc: func(string) bool { return false },
+		ScheduleFunc: func(ctx context.Context, _ time.Duration, _ string, _ func() (time.Duration, bool)) {
+			scheduled <- ctx
+		},
+	}
+
+	requestCtx, cancel := context.WithCancel(context.Background())
+	manager.schedulePeerLoginExpiration(requestCtx, accountID)
+	cancel()
+
+	select {
+	case jobCtx := <-scheduled:
+		assert.NoError(t, jobCtx.Err(), "the expiration job must outlive the request that armed it")
+	case <-time.After(time.Second):
+		t.Fatal("timeout while waiting for the job to be scheduled")
+	}
+}
+
+func TestDefaultAccountManager_ExpireAndUpdatePeers_SkipsPeerThatLoggedInAgain(t *testing.T) {
+	manager, updateManager, err := createManager(t)
+	require.NoError(t, err, "unable to create account manager")
+
+	accountID, err := manager.GetAccountIDByUserID(context.Background(), auth.UserAuth{UserId: userID})
+	require.NoError(t, err, "unable to create an account")
+
+	reloggedKey, staleKey := addExpiringPeers(t, manager)
+	_, err = manager.UpdateAccountSettings(context.Background(), accountID, userID, &types.Settings{
+		PeerLoginExpiration:        time.Hour,
+		PeerLoginExpirationEnabled: true,
+		Extra:                      &types.ExtraSettings{},
+	})
+	require.NoError(t, err, "expecting to update account settings successfully but got error")
+	manager.peerLoginExpiry.CancelAll(context.Background())
+
+	expiredLogin := time.Now().UTC().Add(-2 * time.Hour)
+	setPeerLogin(t, manager, accountID, reloggedKey, true, expiredLogin)
+	setPeerLogin(t, manager, accountID, staleKey, true, expiredLogin)
+
+	expiredPeers, err := manager.getExpiredPeers(context.Background(), accountID)
+	require.NoError(t, err)
+	require.Len(t, expiredPeers, 2, "both peers should be due for expiration")
+
+	// The job holds the candidate list while one peer completes a fresh login, which
+	// moves its deadline into the future and must win over the stale candidate entry.
+	setPeerLogin(t, manager, accountID, reloggedKey, true, time.Now().UTC())
+
+	reloggedPeer, err := manager.Store.GetPeerByPeerPubKey(context.Background(), store.LockingStrengthNone, reloggedKey)
+	require.NoError(t, err)
+	stalePeer, err := manager.Store.GetPeerByPeerPubKey(context.Background(), store.LockingStrengthNone, staleKey)
+	require.NoError(t, err)
+	updateManager.CreateChannel(context.Background(), reloggedPeer.ID)
+	updateManager.CreateChannel(context.Background(), stalePeer.ID)
+
+	err = manager.expireAndUpdatePeers(context.Background(), accountID, expiredPeers, peerExpirationSessionExpired)
+	require.NoError(t, err)
+
+	reloggedPeer, err = manager.Store.GetPeerByPeerPubKey(context.Background(), store.LockingStrengthNone, reloggedKey)
+	require.NoError(t, err)
+	assert.False(t, reloggedPeer.Status.LoginExpired, "a peer that logged in again must not be flagged from the stale candidate list")
+	assert.True(t, reloggedPeer.Status.Connected, "the re-logged peer must keep its connected status")
+	assert.True(t, updateManager.HasChannel(reloggedPeer.ID), "the re-logged peer's update channel must stay open")
+
+	stalePeer, err = manager.Store.GetPeerByPeerPubKey(context.Background(), store.LockingStrengthNone, staleKey)
+	require.NoError(t, err)
+	assert.True(t, stalePeer.Status.LoginExpired, "a peer that is still due must be flagged")
+	assert.False(t, updateManager.HasChannel(stalePeer.ID), "the expired peer's update channel must be closed")
+}
+
+// addExpiringPeers registers two SSO peers with login expiration enabled and returns their public keys.
+func addExpiringPeers(t *testing.T, manager *DefaultAccountManager) (string, string) {
+	t.Helper()
+	keys := make([]string, 0, 2)
+	for _, hostname := range []string{"connected-peer", "offline-peer"} {
+		key, err := wgtypes.GenerateKey()
+		require.NoError(t, err, "unable to generate WireGuard key")
+		_, _, _, _, err = manager.AddPeer(context.Background(), "", "", userID, &nbpeer.Peer{
+			Key:                    key.PublicKey().String(),
+			Meta:                   nbpeer.PeerSystemMeta{Hostname: hostname},
+			LoginExpirationEnabled: true,
+		}, false)
+		require.NoError(t, err, "unable to add peer")
+		keys = append(keys, key.PublicKey().String())
+	}
+	return keys[0], keys[1]
+}
+
+func setPeerLogin(t *testing.T, manager *DefaultAccountManager, accountID, peerKey string, connected bool, lastLogin time.Time) {
+	t.Helper()
+	peer, err := manager.Store.GetPeerByPeerPubKey(context.Background(), store.LockingStrengthNone, peerKey)
+	require.NoError(t, err)
+	peer.Status.Connected = connected
+	peer.LastLogin = &lastLogin
+	require.NoError(t, manager.Store.SavePeer(context.Background(), accountID, peer))
+}
+
 func TestDefaultAccountManager_MarkPeerDisconnected_SchedulesInactivityExpiration(t *testing.T) {
 	manager, _, err := createManager(t)
 	require.NoError(t, err, "unable to create account manager")
@@ -2702,7 +2850,7 @@ func TestAccount_GetNextPeerExpiration(t *testing.T) {
 			expectedNextExpiration: time.Duration(0),
 		},
 		{
-			name: "No connected peers, no expiration",
+			name: "Offline peer with expiration, return expiration",
 			peers: map[string]*nbpeer.Peer{
 				"peer-1": {
 					Status: &nbpeer.PeerStatus{
@@ -2721,8 +2869,33 @@ func TestAccount_GetNextPeerExpiration(t *testing.T) {
 			},
 			expiration:             time.Second,
 			expirationEnabled:      false,
-			expectedNextRun:        false,
-			expectedNextExpiration: time.Duration(0),
+			expectedNextRun:        true,
+			expectedNextExpiration: time.Second,
+		},
+		{
+			name: "Offline peer with the earliest deadline defines the next run",
+			peers: map[string]*nbpeer.Peer{
+				"peer-1": {
+					Status: &nbpeer.PeerStatus{
+						Connected: true,
+					},
+					LoginExpirationEnabled: true,
+					LastLogin:              util.ToPtr(time.Now().UTC()),
+					UserID:                 userID,
+				},
+				"peer-2": {
+					Status: &nbpeer.PeerStatus{
+						Connected: false,
+					},
+					LoginExpirationEnabled: true,
+					LastLogin:              util.ToPtr(time.Now().UTC().Add(-50 * time.Minute)),
+					UserID:                 userID,
+				},
+			},
+			expiration:             time.Hour,
+			expirationEnabled:      true,
+			expectedNextRun:        true,
+			expectedNextExpiration: 10 * time.Minute,
 		},
 		{
 			name: "Connected peers with disabled expiration, no expiration",
diff --git a/management/server/activity/codes.go b/management/server/activity/codes.go
index 4d50fee3e..dca043027 100644
--- a/management/server/activity/codes.go
+++ b/management/server/activity/codes.go
@@ -284,6 +284,9 @@ const (
 	// AgentNetworkSettingsDeleted indicates that a user deleted the Agent Network account settings, releasing the endpoint
 	AgentNetworkSettingsDeleted Activity = 142
 
+	// CustomDomainValidationExpired indicates that an unvalidated domain registration expired.
+	CustomDomainValidationExpired Activity = 143
+
 	AccountDeleted Activity = 99999
 )
 
@@ -461,9 +464,10 @@ var activityMap = map[Activity]Code{
 	AccountMetricsPushEnabled:  {"Account metrics push enabled", "account.setting.metrics.push.enable"},
 	AccountMetricsPushDisabled: {"Account metrics push disabled", "account.setting.metrics.push.disable"},
 
-	DomainAdded:     {"Domain added", "domain.add"},
-	DomainDeleted:   {"Domain deleted", "domain.delete"},
-	DomainValidated: {"Domain validated", "domain.validate"},
+	DomainAdded:                   {"Domain added", "domain.add"},
+	DomainDeleted:                 {"Domain deleted", "domain.delete"},
+	DomainValidated:               {"Domain validated", "domain.validate"},
+	CustomDomainValidationExpired: {"Unvalidated domain registration expired", "domain.validation.expire"},
 }
 
 // StringCode returns a string code of the activity
diff --git a/management/server/activity/store/sql_store.go b/management/server/activity/store/sql_store.go
index 73e8e295c..5b0f23dd0 100644
--- a/management/server/activity/store/sql_store.go
+++ b/management/server/activity/store/sql_store.go
@@ -165,16 +165,16 @@ func (store *Store) Get(ctx context.Context, accountID string, offset, limit int
 	return store.processResult(ctx, events)
 }
 
-// Save an event in the SQLite events table end encrypt the "email" element in meta map
-func (store *Store) Save(_ context.Context, event *activity.Event) (*activity.Event, error) {
+// Save persists an activity event and encrypts deleted user details using the caller's context.
+func (store *Store) Save(ctx context.Context, event *activity.Event) (*activity.Event, error) {
 	eventCopy := event.Copy()
-	meta, err := store.saveDeletedUserEmailAndNameInEncrypted(eventCopy)
+	meta, err := store.saveDeletedUserEmailAndNameInEncrypted(ctx, eventCopy)
 	if err != nil {
 		return nil, err
 	}
 	eventCopy.Meta = meta
 
-	if err = store.db.Create(eventCopy).Error; err != nil {
+	if err = store.db.WithContext(ctx).Create(eventCopy).Error; err != nil {
 		return nil, err
 	}
 
@@ -183,7 +183,7 @@ func (store *Store) Save(_ context.Context, event *activity.Event) (*activity.Ev
 
 // saveDeletedUserEmailAndNameInEncrypted if the meta contains email and name then store it in encrypted way and delete
 // this item from meta map
-func (store *Store) saveDeletedUserEmailAndNameInEncrypted(event *activity.Event) (map[string]any, error) {
+func (store *Store) saveDeletedUserEmailAndNameInEncrypted(ctx context.Context, event *activity.Event) (map[string]any, error) {
 	email, ok := event.Meta["email"]
 	if !ok {
 		return event.Meta, nil
@@ -211,7 +211,7 @@ func (store *Store) saveDeletedUserEmailAndNameInEncrypted(event *activity.Event
 	}
 	deletedUser.Name = encryptedName
 
-	err = store.db.Clauses(clause.OnConflict{
+	err = store.db.WithContext(ctx).Clauses(clause.OnConflict{
 		Columns:   []clause.Column{{Name: "id"}},
 		DoUpdates: clause.AssignmentColumns([]string{"email", "name"}),
 	}).Create(deletedUser).Error
diff --git a/management/server/activity/store/sql_store_test.go b/management/server/activity/store/sql_store_test.go
index d723f1623..0a68858e4 100644
--- a/management/server/activity/store/sql_store_test.go
+++ b/management/server/activity/store/sql_store_test.go
@@ -7,11 +7,49 @@ import (
 	"time"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 
 	"github.com/netbirdio/netbird/management/server/activity"
 	"github.com/netbirdio/netbird/util/crypt"
 )
 
+func TestSave_CancellationWhileWaitingForConnection(t *testing.T) {
+	t.Setenv(storeEngineEnv, "sqlite")
+	key, err := crypt.GenerateKey()
+	require.NoError(t, err)
+	store, err := NewSqlStore(context.Background(), t.TempDir(), key)
+	require.NoError(t, err)
+	t.Cleanup(func() { assert.NoError(t, store.Close(context.Background())) })
+	db, err := store.db.DB()
+	require.NoError(t, err)
+	conn, err := db.Conn(context.Background())
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = conn.Close() })
+	ctx, cancel := context.WithTimeout(context.Background(), 50*time.Millisecond)
+	defer cancel()
+	result := make(chan error, 1)
+	go func() {
+		_, err := store.Save(ctx, &activity.Event{
+			Timestamp: time.Now().UTC(), Activity: activity.CustomDomainValidationExpired,
+			AccountID: "account-id", TargetID: "domain-id", InitiatorID: activity.SystemInitiator,
+		})
+		result <- err
+	}()
+	select {
+	case err := <-result:
+		assert.ErrorIs(t, err, context.DeadlineExceeded)
+		require.NoError(t, conn.Close())
+	case <-time.After(time.Second):
+		// Release the connection so a regression cannot leave the writer running.
+		require.NoError(t, conn.Close())
+		assert.ErrorIs(t, <-result, context.DeadlineExceeded)
+		t.Error("activity writes must stop waiting when their deadline expires")
+	}
+	events, err := store.Get(context.Background(), "account-id", 0, 10, true)
+	require.NoError(t, err)
+	assert.Empty(t, events, "a timed-out write must not persist after the connection is released")
+}
+
 func TestNewSqlStore(t *testing.T) {
 	dataDir := t.TempDir()
 	key, _ := crypt.GenerateKey()
diff --git a/management/server/event.go b/management/server/event.go
index 4211f2dda..2b1ac4987 100644
--- a/management/server/event.go
+++ b/management/server/event.go
@@ -61,23 +61,34 @@ func (am *DefaultAccountManager) GetEvents(ctx context.Context, accountID, userI
 	return filtered, nil
 }
 
+// StoreEvent records an activity, waiting for expiration events before cleanup can stop.
 func (am *DefaultAccountManager) StoreEvent(ctx context.Context, initiatorID, targetID, accountID string, activityID activity.ActivityDescriber, meta map[string]any) {
-	if isEnabled() {
-		go func() {
-			_, err := am.eventStore.Save(ctx, &activity.Event{
-				Timestamp:   time.Now().UTC(),
-				Activity:    activityID.(activity.Activity),
-				InitiatorID: initiatorID,
-				TargetID:    targetID,
-				AccountID:   accountID,
-				Meta:        meta,
-			})
-			if err != nil {
-				// todo add metric
-				log.WithContext(ctx).Errorf("received an error while storing an activity event, error: %s", err)
-			}
-		}()
+	if !isEnabled() {
+		return
 	}
+	eventStore := am.eventStore
+	save := func(ctx context.Context) {
+		_, err := eventStore.Save(ctx, &activity.Event{
+			Timestamp:   time.Now().UTC(),
+			Activity:    activityID.(activity.Activity),
+			InitiatorID: initiatorID,
+			TargetID:    targetID,
+			AccountID:   accountID,
+			Meta:        meta,
+		})
+		if err != nil {
+			log.WithContext(ctx).Errorf("received an error while storing an activity event, error: %s", err)
+		}
+	}
+	if activityID == activity.CustomDomainValidationExpired {
+		// The domain is already deleted; shutdown must allow its audit write to finish.
+		ctx, cancel := context.WithTimeout(context.WithoutCancel(ctx), 5*time.Second)
+		defer cancel()
+		save(ctx)
+		return
+	}
+	// Request cancellation must not discard the audit record of a completed operation.
+	go save(context.WithoutCancel(ctx))
 }
 
 type eventUserInfo struct {
diff --git a/management/server/event_test.go b/management/server/event_test.go
index 420e69866..6fb3f437f 100644
--- a/management/server/event_test.go
+++ b/management/server/event_test.go
@@ -6,10 +6,52 @@ import (
 	"time"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 
 	"github.com/netbirdio/netbird/management/server/activity"
+	activitystore "github.com/netbirdio/netbird/management/server/activity/store"
+	"github.com/netbirdio/netbird/util/crypt"
 )
 
+func TestStoreEvent_CanceledContext(t *testing.T) {
+	t.Setenv("NB_EVENT_ACTIVITY_LOG_ENABLED", "true")
+	t.Setenv("NB_ACTIVITY_EVENT_STORE_ENGINE", "sqlite")
+	for _, code := range []activity.Activity{activity.CustomDomainValidationExpired, activity.DomainAdded} {
+		t.Run(code.StringCode(), func(t *testing.T) {
+			dir := t.TempDir()
+			key, err := crypt.GenerateKey()
+			require.NoError(t, err)
+			eventStore, err := activitystore.NewSqlStore(context.Background(), dir, key)
+			require.NoError(t, err)
+			t.Cleanup(func() { assert.NoError(t, eventStore.Close(context.Background())) })
+			manager := &DefaultAccountManager{eventStore: eventStore}
+			ctx, cancel := context.WithCancel(context.Background())
+			cancel()
+
+			// The operation already succeeded when shutdown or the request cancels its context.
+			manager.StoreEvent(ctx, activity.SystemInitiator, "domain-id", "account-id",
+				code, map[string]any{"domain": "expired.example.com"})
+			if code != activity.CustomDomainValidationExpired {
+				require.Eventually(t, func() bool {
+					events, err := eventStore.Get(context.Background(), "account-id", 0, 10, true)
+					return err == nil && len(events) == 1
+				}, time.Second, time.Millisecond, "asynchronous events must survive request cancellation")
+			}
+			require.NoError(t, eventStore.Close(context.Background()))
+
+			reopened, err := activitystore.NewSqlStore(context.Background(), dir, key)
+			require.NoError(t, err)
+			t.Cleanup(func() { assert.NoError(t, reopened.Close(context.Background())) })
+			events, err := reopened.Get(context.Background(), "account-id", 0, 10, true)
+			require.NoError(t, err)
+			require.Len(t, events, 1, "the event must be persisted before shutdown closes the store")
+			assert.Equal(t, code, events[0].Activity, "persist the requested activity")
+			assert.Equal(t, "domain-id", events[0].TargetID, "retain the registration ID")
+			assert.Equal(t, "expired.example.com", events[0].Meta["domain"], "retain the domain name")
+		})
+	}
+}
+
 func generateAndStoreEvents(t *testing.T, manager *DefaultAccountManager, typ activity.Activity, initiatorID, targetID,
 	accountID string, count int) {
 	t.Helper()
diff --git a/management/server/group.go b/management/server/group.go
index 33870f25e..88295e2f6 100644
--- a/management/server/group.go
+++ b/management/server/group.go
@@ -101,10 +101,8 @@ func (am *DefaultAccountManager) CreateGroup(ctx context.Context, accountID, use
 			return status.Errorf(status.Internal, "failed to create group: %v", err)
 		}
 
-		for _, peerID := range newGroup.Peers {
-			if err := transaction.AddPeerToGroup(ctx, accountID, peerID, newGroup.ID); err != nil {
-				return status.Errorf(status.Internal, "failed to add peer %s to group %s: %v", peerID, newGroup.ID, err)
-			}
+		if err = syncGroupMembership(ctx, transaction, accountID, newGroup.ID, newGroup.Peers, nil); err != nil {
+			return err
 		}
 
 		snap, err = affectedpeers.Load(ctx, transaction, accountID, change)
@@ -200,6 +198,9 @@ func (am *DefaultAccountManager) UpdateGroup(ctx context.Context, accountID, use
 
 // syncGroupMembership applies the peer membership delta for a group within a transaction.
 func syncGroupMembership(ctx context.Context, transaction store.Store, accountID, groupID string, peersToAdd, peersToRemove []string) error {
+	if err := validateGroupPeers(ctx, transaction, accountID, peersToAdd); err != nil {
+		return err
+	}
 	for _, peerID := range peersToAdd {
 		if err := transaction.AddPeerToGroup(ctx, accountID, peerID, groupID); err != nil {
 			return status.Errorf(status.Internal, "failed to add peer %s to group %s: %v", peerID, groupID, err)
@@ -213,6 +214,25 @@ func syncGroupMembership(ctx context.Context, transaction store.Store, accountID
 	return nil
 }
 
+func validateGroupPeers(ctx context.Context, transaction store.Store, accountID string, peerIDs []string) error {
+	if len(peerIDs) == 0 {
+		return nil
+	}
+
+	peers, err := transaction.GetPeersByIDs(ctx, store.LockingStrengthNone, accountID, peerIDs)
+	if err != nil {
+		return err
+	}
+
+	for _, peerID := range peerIDs {
+		if _, ok := peers[peerID]; !ok {
+			return status.Errorf(status.InvalidArgument, "peer with ID %s not found", peerID)
+		}
+	}
+
+	return nil
+}
+
 // CreateGroups adds new groups to the account.
 // Note: This function does not acquire the global lock.
 // It is the caller's responsibility to ensure proper locking is in place before invoking this method.
@@ -540,7 +560,7 @@ func (am *DefaultAccountManager) GroupAddPeer(ctx context.Context, accountID, gr
 	change := affectedpeers.Change{OutputPeerIDs: []string{peerID}, LinkGroups: []string{groupID}}
 
 	err := am.Store.ExecuteInTransaction(ctx, func(transaction store.Store) error {
-		if err := transaction.AddPeerToGroup(ctx, accountID, peerID, groupID); err != nil {
+		if err := syncGroupMembership(ctx, transaction, accountID, groupID, []string{peerID}, nil); err != nil {
 			return err
 		}
 
@@ -754,6 +774,14 @@ func validateDeleteGroup(ctx context.Context, transaction store.Store, group *ty
 		return &GroupLinkError{"agent network policy", linkedPolicy.Name}
 	}
 
+	isLinked, linkedRule, err := isGroupLinkedToAgentNetworkBudgetRule(ctx, transaction, group.AccountID, group.ID)
+	if err != nil {
+		return status.Errorf(status.Internal, "failed to check agent network budget rules")
+	}
+	if isLinked {
+		return &GroupLinkError{"agent network budget rule", linkedRule.Name}
+	}
+
 	return checkGroupLinkedToSettings(ctx, transaction, group)
 }
 
@@ -925,6 +953,26 @@ func isGroupLinkedToAgentNetworkPolicy(ctx context.Context, transaction store.St
 	return false, nil
 }
 
+// isGroupLinkedToAgentNetworkBudgetRule checks if a group is a target of any
+// account-level agent network budget rule.
+func isGroupLinkedToAgentNetworkBudgetRule(ctx context.Context, transaction store.Store, accountID string, groupID string) (bool, *agentNetworkTypes.AccountBudgetRule, error) {
+	rules, err := transaction.GetAccountAgentNetworkBudgetRules(ctx, store.LockingStrengthNone, accountID)
+	if err != nil {
+		log.WithContext(ctx).Errorf("error retrieving agent network budget rules while checking group linkage: %v", err)
+		return false, nil, err
+	}
+
+	for _, rule := range rules {
+		if rule == nil {
+			continue
+		}
+		if slices.Contains(rule.TargetGroups, groupID) {
+			return true, rule, nil
+		}
+	}
+	return false, nil, nil
+}
+
 // areGroupChangesAffectPeers checks if any changes to the specified groups will affect peers.
 // It fetches each collection once and checks all groupIDs against them in memory.
 func areGroupChangesAffectPeers(ctx context.Context, transaction store.Store, accountID string, groupIDs []string) (bool, error) {
diff --git a/management/server/group_test.go b/management/server/group_test.go
index f5aeceea8..fa351a43e 100644
--- a/management/server/group_test.go
+++ b/management/server/group_test.go
@@ -11,10 +11,10 @@ import (
 	"testing"
 	"time"
 
-	"go.uber.org/mock/gomock"
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
 	"golang.org/x/exp/maps"
 
 	nbdns "github.com/netbirdio/netbird/dns"
@@ -132,6 +132,11 @@ func TestDefaultAccountManager_DeleteGroup(t *testing.T) {
 			"grp-for-agent-network-policy",
 			"agent network policy",
 		},
+		{
+			"agent network budget rule",
+			"grp-for-agent-network-budget-rule",
+			"agent network budget rule",
+		},
 		{
 			"reverse proxy private service access group",
 			"grp-for-rp-private",
@@ -152,6 +157,16 @@ func TestDefaultAccountManager_DeleteGroup(t *testing.T) {
 				return
 			}
 
+			group, getErr := am.GetGroup(context.Background(), account.Id, testCase.groupID, groupAdminUserID)
+			if getErr != nil {
+				t.Errorf("group %s should still exist after failed deletion: %s", testCase.groupID, getErr)
+				return
+			}
+			if group == nil {
+				t.Errorf("group %s was deleted despite the failed deletion", testCase.groupID)
+				return
+			}
+
 			var sErr *status.Error
 			if errors.As(err, &sErr) {
 				if sErr.Message != testCase.expectedReason {
@@ -240,6 +255,12 @@ func TestDefaultAccountManager_DeleteGroups(t *testing.T) {
 			groupIDs:        []string{"grp-for-agent-network-policy"},
 			expectedReasons: []string{"agent network policy"},
 		},
+		{
+			name:               "agent network budget rule",
+			groupIDs:           []string{"grp-for-agent-network-budget-rule"},
+			expectedReasons:    []string{"agent network budget rule"},
+			expectedNotDeleted: []string{"grp-for-agent-network-budget-rule"},
+		},
 		{
 			name:               "reverse proxy services",
 			groupIDs:           []string{"grp-for-rp-private", "grp-for-rp-bearer"},
@@ -501,6 +522,14 @@ func initTestGroupAccount(am *DefaultAccountManager) (*DefaultAccountManager, *t
 		Peers:     make([]string, 0),
 	}
 
+	groupForAgentNetworkBudgetRule := &types.Group{
+		ID:        "grp-for-agent-network-budget-rule",
+		AccountID: "account-id",
+		Name:      "Group for agent network budget rules",
+		Issued:    types.GroupIssuedAPI,
+		Peers:     make([]string, 0),
+	}
+
 	groupForRPPrivate := &types.Group{
 		ID:        "grp-for-rp-private",
 		AccountID: "account-id",
@@ -573,6 +602,7 @@ func initTestGroupAccount(am *DefaultAccountManager) (*DefaultAccountManager, *t
 	_ = am.CreateGroup(context.Background(), accountID, groupAdminUserID, groupForUsers)
 	_ = am.CreateGroup(context.Background(), accountID, groupAdminUserID, groupForIntegration)
 	_ = am.CreateGroup(context.Background(), accountID, groupAdminUserID, groupForAgentNetworkPolicy)
+	_ = am.CreateGroup(context.Background(), accountID, groupAdminUserID, groupForAgentNetworkBudgetRule)
 	_ = am.CreateGroup(context.Background(), accountID, groupAdminUserID, groupForRPPrivate)
 	_ = am.CreateGroup(context.Background(), accountID, groupAdminUserID, groupForRPBearer)
 
@@ -587,6 +617,20 @@ func initTestGroupAccount(am *DefaultAccountManager) (*DefaultAccountManager, *t
 		return nil, nil, err
 	}
 
+	budgetRuleDecoy := agentNetworkTypes.NewAccountBudgetRule(accountID)
+	budgetRuleDecoy.Name = "Unrelated agent network budget rule"
+	budgetRuleDecoy.TargetGroups = []string{"unrelated-group"}
+	if err := am.Store.SaveAgentNetworkBudgetRule(context.Background(), budgetRuleDecoy); err != nil {
+		return nil, nil, err
+	}
+
+	budgetRule := agentNetworkTypes.NewAccountBudgetRule(accountID)
+	budgetRule.Name = "Example agent network budget rule"
+	budgetRule.TargetGroups = []string{groupForAgentNetworkBudgetRule.ID}
+	if err := am.Store.SaveAgentNetworkBudgetRule(context.Background(), budgetRule); err != nil {
+		return nil, nil, err
+	}
+
 	// The decoy services are created first so the linkage check has to scan
 	// past services that do not reference the groups under test.
 	rpServices := []*rpservice.Service{
@@ -1236,3 +1280,82 @@ func Test_IncrementNetworkSerial(t *testing.T) {
 
 	assert.Equal(t, totalPeers, int(account.Network.Serial), "Expected %d serial increases in account %s, got %d", totalPeers, accountID, account.Network.Serial)
 }
+
+func TestDefaultAccountManager_GroupPeersMustBelongToAccount(t *testing.T) {
+	manager, _, account, peer1, _, _ := setupNetworkMapTest(t)
+
+	otherAccount, err := createAccount(manager, "other_account", "other_user", "")
+	require.NoError(t, err)
+
+	foreignPeer := &peer2.Peer{
+		ID:        "foreign-peer",
+		AccountID: otherAccount.Id,
+		Key:       "foreign-key",
+		DNSLabel:  "foreign-peer",
+		IP:        uint32ToIP(1),
+	}
+	require.NoError(t, manager.Store.AddPeerToAccount(context.Background(), foreignPeer))
+
+	assertRejected := func(t *testing.T, err error) {
+		t.Helper()
+		require.Error(t, err)
+		s, ok := status.FromError(err)
+		require.True(t, ok, "expected status error, got %v", err)
+		assert.Equal(t, status.InvalidArgument, s.Type(), "peer outside the account should be rejected as invalid argument")
+	}
+
+	t.Run("create rejects foreign peer", func(t *testing.T) {
+		err := manager.CreateGroup(context.Background(), account.Id, userID, &types.Group{
+			Name:   "foreign",
+			Issued: types.GroupIssuedAPI,
+			Peers:  []string{peer1.ID, foreignPeer.ID},
+		})
+		assertRejected(t, err)
+
+		_, err = manager.Store.GetGroupByName(context.Background(), store.LockingStrengthNone, account.Id, "foreign")
+		assert.Error(t, err, "rejected create must not persist the group")
+	})
+
+	t.Run("update rejects foreign and unknown peers", func(t *testing.T) {
+		group := &types.Group{ID: "own", Name: "own", Issued: types.GroupIssuedAPI, Peers: []string{peer1.ID}}
+		require.NoError(t, manager.CreateGroup(context.Background(), account.Id, userID, group))
+
+		group.Peers = []string{peer1.ID, foreignPeer.ID}
+		assertRejected(t, manager.UpdateGroup(context.Background(), account.Id, userID, group))
+
+		group.Peers = []string{peer1.ID, "does-not-exist"}
+		assertRejected(t, manager.UpdateGroup(context.Background(), account.Id, userID, group))
+
+		stored, err := manager.Store.GetGroupByID(context.Background(), store.LockingStrengthNone, account.Id, group.ID)
+		require.NoError(t, err)
+		assert.Equal(t, []string{peer1.ID}, stored.Peers, "rejected updates must not change membership")
+	})
+
+	t.Run("update tolerates and drops pre-existing dangling members", func(t *testing.T) {
+		group := &types.Group{ID: "polluted", Name: "polluted", Issued: types.GroupIssuedAPI, Peers: []string{peer1.ID}}
+		require.NoError(t, manager.CreateGroup(context.Background(), account.Id, userID, group))
+		require.NoError(t, manager.Store.AddPeerToGroup(context.Background(), account.Id, foreignPeer.ID, group.ID))
+
+		group.Peers = []string{peer1.ID, foreignPeer.ID}
+		assert.NoError(t, manager.UpdateGroup(context.Background(), account.Id, userID, group), "keeping an existing member must not be rejected")
+
+		group.Peers = []string{peer1.ID}
+		require.NoError(t, manager.UpdateGroup(context.Background(), account.Id, userID, group))
+
+		stored, err := manager.Store.GetGroupByID(context.Background(), store.LockingStrengthNone, account.Id, group.ID)
+		require.NoError(t, err)
+		assert.Equal(t, []string{peer1.ID}, stored.Peers, "dangling member should be removed once omitted")
+	})
+
+	t.Run("direct add rejects foreign and unknown peers", func(t *testing.T) {
+		group := &types.Group{ID: "direct", Name: "direct", Issued: types.GroupIssuedAPI, Peers: []string{peer1.ID}}
+		require.NoError(t, manager.CreateGroup(context.Background(), account.Id, userID, group))
+
+		assertRejected(t, manager.GroupAddPeer(context.Background(), account.Id, group.ID, foreignPeer.ID))
+		assertRejected(t, manager.GroupAddPeer(context.Background(), account.Id, group.ID, "does-not-exist"))
+
+		stored, err := manager.Store.GetGroupByID(context.Background(), store.LockingStrengthNone, account.Id, group.ID)
+		require.NoError(t, err)
+		assert.Equal(t, []string{peer1.ID}, stored.Peers, "rejected direct adds must not change membership")
+	})
+}
diff --git a/management/server/http/testing/integration/events_handler_integration_test.go b/management/server/http/testing/integration/events_handler_integration_test.go
index 6611b60ee..a051aabcd 100644
--- a/management/server/http/testing/integration/events_handler_integration_test.go
+++ b/management/server/http/testing/integration/events_handler_integration_test.go
@@ -3,6 +3,7 @@
 package integration
 
 import (
+	"context"
 	"encoding/json"
 	"net/http"
 	"net/http/httptest"
@@ -10,6 +11,7 @@ import (
 	"time"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 
 	"github.com/netbirdio/netbird/management/server/http/testing/testing_tools"
 	"github.com/netbirdio/netbird/management/server/http/testing/testing_tools/channel"
@@ -34,7 +36,7 @@ func Test_Events_GetAll(t *testing.T) {
 
 	for _, user := range users {
 		t.Run(user.name+" - Get all events", func(t *testing.T) {
-			apiHandler, _, _ := channel.BuildApiBlackBoxWithDBState(t, "../testdata/events.sql", nil, false)
+			apiHandler, accountManager, _ := channel.BuildApiBlackBoxWithDBState(t, "../testdata/events.sql", nil, false)
 
 			// First, perform a mutation to generate an event (create a group as admin)
 			groupBody, err := json.Marshal(&api.GroupRequest{Name: "eventTestGroup"})
@@ -44,7 +46,14 @@ func Test_Events_GetAll(t *testing.T) {
 			createReq := testing_tools.BuildRequest(t, groupBody, http.MethodPost, "/api/groups", testing_tools.TestAdminId)
 			createRecorder := httptest.NewRecorder()
 			apiHandler.ServeHTTP(createRecorder, createReq)
-			assert.Equal(t, http.StatusOK, createRecorder.Code, "Failed to create group to generate event")
+			require.Equal(t, http.StatusOK, createRecorder.Code, "Failed to create group to generate event")
+
+			// Group creation returns before its asynchronous audit write finishes.
+			require.EventuallyWithT(t, func(c *assert.CollectT) {
+				events, err := accountManager.GetEvents(context.Background(), testing_tools.TestAccountId, testing_tools.TestAdminId)
+				assert.NoError(c, err)
+				assert.NotEmpty(c, events, "wait for the group creation event before checking permissions")
+			}, time.Second, 10*time.Millisecond)
 
 			// Now query events
 			req := testing_tools.BuildRequest(t, []byte{}, http.MethodGet, "/api/events", user.userId)
diff --git a/management/server/identity_provider.go b/management/server/identity_provider.go
index 86bbcd893..764d8598b 100644
--- a/management/server/identity_provider.go
+++ b/management/server/identity_provider.go
@@ -23,6 +23,9 @@ import (
 	"github.com/netbirdio/netbird/shared/management/status"
 )
 
+// maxDiscoveryDocumentSize caps the discovery document read at 1 MiB. Providers serve a few kilobytes.
+const maxDiscoveryDocumentSize = 1 << 20
+
 // oidcProviderJSON represents the OpenID Connect discovery document
 type oidcProviderJSON struct {
 	Issuer string `json:"issuer"`
@@ -35,6 +38,10 @@ func validateOIDCIssuer(ctx context.Context, issuer string) error {
 
 	httpClient := &http.Client{
 		Timeout: 10 * time.Second,
+		// An issuer that redirects its own discovery document is misconfigured.
+		CheckRedirect: func(*http.Request, []*http.Request) error {
+			return http.ErrUseLastResponse
+		},
 	}
 
 	req, err := http.NewRequestWithContext(ctx, http.MethodGet, wellKnown, nil)
@@ -48,22 +55,22 @@ func validateOIDCIssuer(ctx context.Context, issuer string) error {
 	}
 	defer resp.Body.Close()
 
-	body, err := io.ReadAll(resp.Body)
-	if err != nil {
-		return fmt.Errorf("%w: unable to read response body: %v", types.ErrIdentityProviderIssuerUnreachable, err)
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("%w: %s", types.ErrIdentityProviderIssuerUnreachable, resp.Status)
 	}
 
-	if resp.StatusCode != http.StatusOK {
-		return fmt.Errorf("%w: %s: %s", types.ErrIdentityProviderIssuerUnreachable, resp.Status, body)
+	body, err := io.ReadAll(io.LimitReader(resp.Body, maxDiscoveryDocumentSize+1))
+	if err != nil || len(body) > maxDiscoveryDocumentSize {
+		return fmt.Errorf("%w: failed to decode provider discovery object", types.ErrIdentityProviderIssuerUnreachable)
 	}
 
 	var p oidcProviderJSON
 	if err := json.Unmarshal(body, &p); err != nil {
-		return fmt.Errorf("%w: failed to decode provider discovery object: %v", types.ErrIdentityProviderIssuerUnreachable, err)
+		return fmt.Errorf("%w: failed to decode provider discovery object", types.ErrIdentityProviderIssuerUnreachable)
 	}
 
 	if p.Issuer != issuer {
-		return fmt.Errorf("%w: expected %q got %q", types.ErrIdentityProviderIssuerMismatch, issuer, p.Issuer)
+		return fmt.Errorf("%w: %q", types.ErrIdentityProviderIssuerMismatch, issuer)
 	}
 
 	return nil
@@ -151,15 +158,15 @@ func (am *DefaultAccountManager) CreateIdentityProvider(ctx context.Context, acc
 		return nil, status.NewPermissionDeniedError()
 	}
 
-	if err := validateIdentityProviderConfig(ctx, idpConfig); err != nil {
-		return nil, err
-	}
-
 	embeddedManager, ok := am.idpManager.(*idp.EmbeddedIdPManager)
 	if !ok {
 		return nil, status.Errorf(status.Internal, "identity provider management requires embedded IdP")
 	}
 
+	if err := validateIdentityProviderConfig(ctx, idpConfig); err != nil {
+		return nil, err
+	}
+
 	// Generate ID if not provided
 	if idpConfig.ID == "" {
 		idpConfig.ID = generateIdentityProviderID(idpConfig.Type)
@@ -188,15 +195,15 @@ func (am *DefaultAccountManager) UpdateIdentityProvider(ctx context.Context, acc
 		return nil, status.NewPermissionDeniedError()
 	}
 
-	if err := validateIdentityProviderConfig(ctx, idpConfig); err != nil {
-		return nil, err
-	}
-
 	embeddedManager, ok := am.idpManager.(*idp.EmbeddedIdPManager)
 	if !ok {
 		return nil, status.Errorf(status.Internal, "identity provider management requires embedded IdP")
 	}
 
+	if err := validateIdentityProviderConfig(ctx, idpConfig); err != nil {
+		return nil, err
+	}
+
 	idpConfig.ID = idpID
 	idpConfig.AccountID = accountID
 
diff --git a/management/server/identity_provider_test.go b/management/server/identity_provider_test.go
index ecc47337c..c7a8af1d2 100644
--- a/management/server/identity_provider_test.go
+++ b/management/server/identity_provider_test.go
@@ -7,6 +7,7 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"path/filepath"
+	"strings"
 	"testing"
 	"time"
 
@@ -121,7 +122,7 @@ func createManagerWithEmbeddedIdPModeAndSetup(
 }
 
 func TestDefaultAccountManager_CreateIdentityProvider_Validation(t *testing.T) {
-	manager, _, err := createManager(t)
+	manager, _, err := createManagerWithEmbeddedIdP(t)
 	require.NoError(t, err)
 
 	userID := "testingUser"
@@ -233,7 +234,7 @@ func TestUpdateUserAuthWithSingleModeKeepsConfiguredDomain(t *testing.T) {
 }
 
 func TestDefaultAccountManager_UpdateIdentityProvider_Validation(t *testing.T) {
-	manager, _, err := createManager(t)
+	manager, _, err := createManagerWithEmbeddedIdP(t)
 	require.NoError(t, err)
 
 	userID := "testingUser"
@@ -355,3 +356,45 @@ func TestValidateOIDCIssuer_TrailingSlash(t *testing.T) {
 	require.Error(t, err)
 	assert.True(t, errors.Is(err, types.ErrIdentityProviderIssuerMismatch))
 }
+
+func TestValidateOIDCIssuer_DoesNotFollowRedirects(t *testing.T) {
+	var reached bool
+	target := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		reached = true
+		w.WriteHeader(http.StatusForbidden)
+	}))
+	t.Cleanup(target.Close)
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		http.Redirect(w, r, target.URL+"/redirect-target", http.StatusFound)
+	}))
+	t.Cleanup(srv.Close)
+
+	err := validateOIDCIssuer(context.Background(), srv.URL)
+	require.Error(t, err)
+	assert.False(t, reached, "Redirects are not followed")
+}
+
+func TestValidateOIDCIssuer_BoundsResponseSize(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write([]byte(`{"issuer":"` + strings.Repeat("a", maxDiscoveryDocumentSize) + `"}`))
+	}))
+	t.Cleanup(srv.Close)
+
+	err := validateOIDCIssuer(context.Background(), srv.URL)
+	require.ErrorIs(t, err, types.ErrIdentityProviderIssuerUnreachable)
+	assert.NotErrorIs(t, err, types.ErrIdentityProviderIssuerMismatch)
+}
+
+func TestValidateOIDCIssuer_RejectsTrailingContent(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write([]byte(`{"issuer":"http://` + r.Host + `"} {"issuer":"second"}`))
+	}))
+	t.Cleanup(srv.Close)
+
+	err := validateOIDCIssuer(context.Background(), srv.URL)
+	require.ErrorIs(t, err, types.ErrIdentityProviderIssuerUnreachable,
+		"Content after the first object is not a valid discovery document")
+}
diff --git a/management/server/migration/migration_custom_domain.go b/management/server/migration/migration_custom_domain.go
new file mode 100644
index 000000000..bac784358
--- /dev/null
+++ b/management/server/migration/migration_custom_domain.go
@@ -0,0 +1,22 @@
+package migration
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"gorm.io/gorm"
+
+	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/domain"
+)
+
+// MigrateCustomDomainValidationExpiry gives existing pending registrations a validation window.
+func MigrateCustomDomainValidationExpiry(ctx context.Context, db *gorm.DB) error {
+	result := db.WithContext(ctx).Model(&domain.Domain{}).
+		Where("validated = ? AND validation_expires_at IS NULL", false).
+		Update("validation_expires_at", time.Now().UTC().Add(domain.ValidationTTL))
+	if result.Error != nil {
+		return fmt.Errorf("backfill custom domain validation expiry: %w", result.Error)
+	}
+	return nil
+}
diff --git a/management/server/migration/migration_custom_domain_test.go b/management/server/migration/migration_custom_domain_test.go
new file mode 100644
index 000000000..facf23c9f
--- /dev/null
+++ b/management/server/migration/migration_custom_domain_test.go
@@ -0,0 +1,44 @@
+package migration_test
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/domain"
+	"github.com/netbirdio/netbird/management/server/migration"
+)
+
+func TestMigrateCustomDomainValidationExpiry(t *testing.T) {
+	db := setupDatabase(t)
+	require.NoError(t, db.AutoMigrate(&domain.Domain{}))
+	t.Cleanup(func() { require.NoError(t, db.Migrator().DropTable(&domain.Domain{})) })
+	ctx := context.Background()
+	existingDeadline := time.Now().UTC().Add(time.Hour).Truncate(time.Second)
+	rows := []domain.Domain{
+		{ID: "legacy", Domain: "legacy.example.com"},
+		{ID: "validated", Domain: "validated.example.com", Validated: true},
+		{ID: "pending", Domain: "pending.example.com", ValidationExpiresAt: &existingDeadline},
+	}
+	require.NoError(t, db.Create(&rows).Error)
+	before := time.Now().UTC()
+	require.NoError(t, migration.MigrateCustomDomainValidationExpiry(ctx, db))
+	after := time.Now().UTC()
+	var migrated domain.Domain
+	require.NoError(t, db.First(&migrated, "id = ?", "legacy").Error)
+	require.NotNil(t, migrated.ValidationExpiresAt)
+	assert.WithinRange(t, *migrated.ValidationExpiresAt, before.Truncate(time.Millisecond).Add(48*time.Hour), after.Add(48*time.Hour+time.Millisecond), "legacy pending registrations get a full window")
+	deadline := *migrated.ValidationExpiresAt
+	require.NoError(t, migration.MigrateCustomDomainValidationExpiry(ctx, db))
+	require.NoError(t, db.First(&migrated, "id = ?", "legacy").Error)
+	assert.Equal(t, deadline, *migrated.ValidationExpiresAt, "repeated migration must not extend the deadline")
+	var validated, pending domain.Domain
+	require.NoError(t, db.First(&validated, "id = ?", "validated").Error)
+	require.NoError(t, db.First(&pending, "id = ?", "pending").Error)
+	assert.Nil(t, validated.ValidationExpiresAt, "validated domains do not acquire an expiry")
+	require.NotNil(t, pending.ValidationExpiresAt)
+	assert.WithinDuration(t, existingDeadline, *pending.ValidationExpiresAt, 0, "existing deadlines must be preserved")
+}
diff --git a/management/server/peer.go b/management/server/peer.go
index 07619f51e..9f5572252 100644
--- a/management/server/peer.go
+++ b/management/server/peer.go
@@ -1494,9 +1494,12 @@ func checkAuth(ctx context.Context, loginUserID string, peer *nbpeer.Peer) error
 
 func peerLoginExpired(ctx context.Context, peer *nbpeer.Peer, settings *types.Settings) bool {
 	expired, expiresIn := peer.LoginExpired(settings.PeerLoginExpiration)
-	expired = settings.PeerLoginExpirationEnabled && expired
-	if expired || peer.Status.LoginExpired {
-		log.WithContext(ctx).Debugf("peer's %s login expired %v ago", peer.ID, expiresIn)
+	if settings.PeerLoginExpirationEnabled && expired {
+		log.WithContext(ctx).Debugf("peer's %s login expired %v ago", peer.ID, -expiresIn)
+		return true
+	}
+	if peer.Status.LoginExpired {
+		log.WithContext(ctx).Debugf("peer's %s login is marked as expired", peer.ID)
 		return true
 	}
 	return false
@@ -1643,7 +1646,9 @@ func (am *DefaultAccountManager) UpdateAccountPeer(ctx context.Context, accountI
 
 // getNextPeerExpiration returns the minimum duration in which the next peer of the account will expire if it was found.
 // If there is no peer that expires this function returns false and a duration of 0.
-// This function only considers peers that haven't been expired yet and that are connected.
+// This function only considers peers that haven't been expired yet. Offline peers count too:
+// a running job is never re-armed on connect, so a peer that reconnects with an old login
+// must already be part of the scheduled run.
 func (am *DefaultAccountManager) getNextPeerExpiration(ctx context.Context, accountID string) (time.Duration, bool) {
 	peersWithExpiry, err := am.Store.GetAccountPeersWithExpiration(ctx, store.LockingStrengthNone, accountID)
 	if err != nil {
@@ -1663,8 +1668,7 @@ func (am *DefaultAccountManager) getNextPeerExpiration(ctx context.Context, acco
 
 	var nextExpiry *time.Duration
 	for _, peer := range peersWithExpiry {
-		// consider only connected peers because others will require login on connecting to the management server
-		if peer.Status.LoginExpired || !peer.Status.Connected {
+		if peer.Status.LoginExpired {
 			continue
 		}
 		_, duration := peer.LoginExpired(settings.PeerLoginExpiration)
diff --git a/management/server/scheduler.go b/management/server/scheduler.go
index b61643295..1daea4295 100644
--- a/management/server/scheduler.go
+++ b/management/server/scheduler.go
@@ -117,6 +117,7 @@ func (wm *DefaultScheduler) Schedule(ctx context.Context, in time.Duration, ID s
 	}
 
 	ticker := time.NewTicker(in)
+	period := in
 
 	wm.jobs[ID] = cancel
 	log.WithContext(ctx).Debugf("scheduled a job %s to run in %s. There are %d total jobs scheduled.", ID, in.String(), len(wm.jobs))
@@ -136,14 +137,18 @@ func (wm *DefaultScheduler) Schedule(ctx context.Context, in time.Duration, ID s
 				if !reschedule {
 					wm.mu.Lock()
 					defer wm.mu.Unlock()
-					delete(wm.jobs, ID)
+					// A Cancel during job() may have registered a replacement under this ID.
+					if current, ok := wm.jobs[ID]; ok && current == cancel {
+						delete(wm.jobs, ID)
+					}
 					log.WithContext(ctx).Debugf("job %s is not scheduled to run again", ID)
 					ticker.Stop()
 					return
 				}
 				// we need this comparison to avoid resetting the ticker with the same duration and missing the current elapsesed time
-				if runIn != in {
+				if runIn != period {
 					ticker.Reset(runIn)
+					period = runIn
 				}
 			case <-cancel:
 				log.WithContext(ctx).Debugf("job %s was canceled, stopping timer", ID)
diff --git a/management/server/scheduler_test.go b/management/server/scheduler_test.go
index e3af551ad..9dd13ce6b 100644
--- a/management/server/scheduler_test.go
+++ b/management/server/scheduler_test.go
@@ -6,10 +6,12 @@ import (
 	"math/rand"
 	"runtime"
 	"sync"
+	"sync/atomic"
 	"testing"
 	"time"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 func TestScheduler_Performance(t *testing.T) {
@@ -150,3 +152,90 @@ func TestScheduler_Schedule(t *testing.T) {
 	scheduler.cancel(context.Background(), jobID)
 
 }
+
+func TestScheduler_Schedule_ResetsTickerAfterReturningInitialInterval(t *testing.T) {
+	jobID := "test-scheduler-job-2"
+	scheduler := NewDefaultScheduler()
+	defer scheduler.Cancel(context.Background(), []string{jobID})
+
+	initial := 30 * time.Millisecond
+	stretched := 400 * time.Millisecond
+	runs := make(chan time.Time, 3)
+	count := 0
+	// The first run stretches the period; the second returns the initial interval again,
+	// which must shrink the period back instead of keeping the stretched one.
+	job := func() (nextRunIn time.Duration, reschedule bool) {
+		count++
+		runs <- time.Now()
+		switch count {
+		case 1:
+			return stretched, true
+		case 2:
+			return initial, true
+		default:
+			return 0, false
+		}
+	}
+	scheduler.Schedule(context.Background(), initial, jobID, job)
+
+	var stamps []time.Time
+	for len(stamps) < 3 {
+		select {
+		case ts := <-runs:
+			stamps = append(stamps, ts)
+		case <-time.After(2 * time.Second):
+			t.Fatalf("timed out after %d runs", len(stamps))
+		}
+	}
+	assert.Less(t, stamps[2].Sub(stamps[1]), stretched/2, "returning the initial interval must reset the stretched ticker")
+}
+
+func TestScheduler_Schedule_StaleCompletionKeepsReplacement(t *testing.T) {
+	jobID := "test-scheduler-job-3"
+	scheduler := NewDefaultScheduler()
+	defer scheduler.Cancel(context.Background(), []string{jobID})
+
+	started := make(chan struct{})
+	release := make(chan struct{})
+	staleJob := func() (nextRunIn time.Duration, reschedule bool) {
+		close(started)
+		<-release
+		return 0, false
+	}
+	scheduler.Schedule(context.Background(), 10*time.Millisecond, jobID, staleJob)
+	select {
+	case <-started:
+	case <-time.After(time.Second):
+		t.Fatal("timed out waiting for the first job to start")
+	}
+
+	// Cancel the job while it is still executing and register a replacement under the
+	// same ID, as the expiration paths do on a settings change.
+	scheduler.Cancel(context.Background(), []string{jobID})
+	var replacementRuns atomic.Int32
+	scheduler.Schedule(context.Background(), 20*time.Millisecond, jobID, func() (nextRunIn time.Duration, reschedule bool) {
+		replacementRuns.Add(1)
+		return 20 * time.Millisecond, true
+	})
+	require.True(t, scheduler.IsSchedulerRunning(jobID), "replacement must be registered")
+
+	// The stale job now completes without rescheduling; its cleanup must leave the
+	// replacement's entry in place.
+	close(release)
+	assert.Never(t, func() bool { return !scheduler.IsSchedulerRunning(jobID) }, 200*time.Millisecond, 10*time.Millisecond,
+		"stale completion must not drop the replacement job")
+
+	var duplicateRuns atomic.Int32
+	scheduler.Schedule(context.Background(), 10*time.Millisecond, jobID, func() (nextRunIn time.Duration, reschedule bool) {
+		duplicateRuns.Add(1)
+		return 10 * time.Millisecond, true
+	})
+	assert.Never(t, func() bool { return duplicateRuns.Load() > 0 }, 100*time.Millisecond, 10*time.Millisecond,
+		"a duplicate schedule must be refused while the replacement is registered")
+
+	scheduler.Cancel(context.Background(), []string{jobID})
+	assert.False(t, scheduler.IsSchedulerRunning(jobID), "cancel must find and remove the replacement")
+	runsAfterCancel := replacementRuns.Load()
+	assert.Never(t, func() bool { return replacementRuns.Load() > runsAfterCancel+1 }, 150*time.Millisecond, 10*time.Millisecond,
+		"the replacement must stop after cancel")
+}
diff --git a/management/server/store/sql_store.go b/management/server/store/sql_store.go
index 6337ebf1a..08ec45395 100644
--- a/management/server/store/sql_store.go
+++ b/management/server/store/sql_store.go
@@ -3473,7 +3473,7 @@ func (s *SqlStore) GetPeerGroups(ctx context.Context, lockStrength LockingStreng
 	var groups []*types.Group
 	query := tx.
 		Joins("JOIN group_peers ON group_peers.group_id = groups.id").
-		Where("group_peers.peer_id = ?", peerId).
+		Where("groups.account_id = ? AND group_peers.peer_id = ?", accountId, peerId).
 		Preload(clause.Associations).
 		Find(&groups)
 
@@ -5053,7 +5053,7 @@ func (s *SqlStore) GetPeersByGroupIDs(ctx context.Context, accountID string, gro
 		Select("DISTINCT peer_id").
 		Where("account_id = ? AND group_id IN ?", accountID, groupIDs)
 
-	result := s.db.Where("id IN (?)", peerIDsSubquery).Find(&peers)
+	result := s.db.Where("account_id = ? AND id IN (?)", accountID, peerIDsSubquery).Find(&peers)
 	if result.Error != nil {
 		log.WithContext(ctx).Errorf("failed to get peers by group IDs: %s", result.Error)
 		return nil, status.Errorf(status.Internal, "failed to get peers by group IDs")
@@ -5686,6 +5686,23 @@ func (s *SqlStore) ListCustomDomains(ctx context.Context, accountID string) ([]*
 	return domains, nil
 }
 
+// GetCustomDomainByName returns the custom domain row holding the given name,
+// regardless of which account owns it.
+func (s *SqlStore) GetCustomDomainByName(ctx context.Context, domainName string) (*domain.Domain, error) {
+	customDomain := &domain.Domain{}
+	result := s.db.Take(customDomain, "domain = ?", domainName)
+	if result.Error != nil {
+		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
+			return nil, status.Errorf(status.NotFound, "custom domain %s not found", domainName)
+		}
+
+		log.WithContext(ctx).Errorf("failed to get custom domain by name from store: %v", result.Error)
+		return nil, status.Errorf(status.Internal, "failed to get custom domain from store")
+	}
+
+	return customDomain, nil
+}
+
 func (s *SqlStore) CreateCustomDomain(ctx context.Context, accountID string, domainName string, targetCluster string, validated bool) (*domain.Domain, error) {
 	newDomain := &domain.Domain{
 		ID:            xid.New().String(), // Generate our own ID because gorm doesn't always configure the database to handle this for us.
@@ -5695,8 +5712,24 @@ func (s *SqlStore) CreateCustomDomain(ctx context.Context, accountID string, dom
 		Type:          domain.TypeCustom,
 		Validated:     validated,
 	}
+	if !validated {
+		expiresAt := time.Now().UTC().Add(domain.ValidationTTL)
+		newDomain.ValidationExpiresAt = &expiresAt
+	}
 	result := s.db.Create(newDomain)
 	if result.Error != nil {
+		// The unique index is the last guard when two requests clear the
+		// manager's availability check at the same time. The one that loses the
+		// insert is a conflict, not an internal failure.
+		var count int64
+		if err := s.db.Model(&domain.Domain{}).Where("domain = ?", domainName).Count(&count).Error; err == nil && count > 0 {
+			// The insert error is logged even on this path: the name being taken
+			// is what the caller has to act on, but if the insert also failed for
+			// an unrelated reason the operator still needs to see it.
+			log.WithContext(ctx).Warnf("create reverse proxy custom domain %s rejected, name already registered: %v", domainName, result.Error)
+			return nil, status.Errorf(status.AlreadyExists, "domain %s is already registered", domainName)
+		}
+
 		log.WithContext(ctx).Errorf("failed to create reverse proxy custom domain to store: %v", result.Error)
 		return nil, status.Errorf(status.Internal, "failed to create reverse proxy custom domain to store")
 	}
@@ -5704,12 +5737,21 @@ func (s *SqlStore) CreateCustomDomain(ctx context.Context, accountID string, dom
 	return newDomain, nil
 }
 
+// UpdateCustomDomain completes validation only while the original registration is pending.
 func (s *SqlStore) UpdateCustomDomain(ctx context.Context, accountID string, d *domain.Domain) (*domain.Domain, error) {
-	d.AccountID = accountID
-	result := s.db.Select("*").Save(d)
+	if !d.Validated {
+		return nil, status.Errorf(status.InvalidArgument, "custom domain update must complete validation")
+	}
+	result := s.db.WithContext(ctx).Model(&domain.Domain{}).
+		Where(accountAndIDQueryCondition, accountID, d.ID).
+		Where("domain = ? AND target_cluster = ?", d.Domain, d.TargetCluster).
+		Where("validated = ? AND validation_expires_at > ?", false, time.Now().UTC()).
+		Update("validated", true)
 	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to update reverse proxy custom domain to store: %v", result.Error)
-		return nil, status.Errorf(status.Internal, "failed to update reverse proxy custom domain to store")
+		return nil, fmt.Errorf("validate custom domain in store: %w", result.Error)
+	}
+	if result.RowsAffected == 0 {
+		return nil, status.Errorf(status.PreconditionFailed, "custom domain registration is no longer pending validation")
 	}
 
 	return d, nil
diff --git a/management/server/store/sql_store_domain_expiration.go b/management/server/store/sql_store_domain_expiration.go
new file mode 100644
index 000000000..525c54084
--- /dev/null
+++ b/management/server/store/sql_store_domain_expiration.go
@@ -0,0 +1,60 @@
+package store
+
+import (
+	"context"
+	"fmt"
+	"strings"
+	"time"
+
+	"gorm.io/gorm"
+
+	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/domain"
+	rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
+	"github.com/netbirdio/netbird/shared/management/status"
+)
+
+// GetExpiredCustomDomains lists pending registrations in stable batches across accounts.
+func (s *SqlStore) GetExpiredCustomDomains(ctx context.Context, now time.Time, afterID domain.ID, limit int) ([]*domain.Domain, error) {
+	var domains []*domain.Domain
+	result := s.db.WithContext(ctx).
+		Where("validated = ? AND validation_expires_at <= ? AND id > ?", false, now, string(afterID)).
+		Order("id").Limit(limit).Find(&domains)
+	if result.Error != nil {
+		return nil, fmt.Errorf("list expired custom domains: %w", result.Error)
+	}
+	return domains, nil
+}
+
+// DeleteExpiredCustomDomain deletes an expired registration only if no service uses its namespace.
+func (s *SqlStore) DeleteExpiredCustomDomain(ctx context.Context, d *domain.Domain, now time.Time) (bool, error) {
+	db := s.db.WithContext(ctx)
+	services := customDomainServices(db, d)
+	result := db.Where(accountAndIDQueryCondition, d.AccountID, d.ID).
+		Where("domain = ? AND validated = ? AND validation_expires_at <= ?", d.Domain, false, now).
+		Where("NOT EXISTS (?)", services.Select("1")).Delete(&domain.Domain{})
+	if result.Error != nil {
+		return false, fmt.Errorf("delete expired custom domain: %w", result.Error)
+	}
+	if result.RowsAffected > 0 {
+		return true, nil
+	}
+	var count int64
+	if err := customDomainServices(db, d).Count(&count).Error; err != nil {
+		return false, fmt.Errorf("check expired custom domain services: %w", err)
+	}
+	if count > 0 {
+		return false, status.Errorf(status.PreconditionFailed, "expired custom domain still has dependent services")
+	}
+	return false, nil
+}
+
+func customDomainServices(db *gorm.DB, d *domain.Domain) *gorm.DB {
+	name := strings.ToLower(strings.TrimSuffix(d.Domain, "."))
+	// Shared domain validation permits underscores, and older rows may contain
+	// other LIKE metacharacters.
+	escaped := strings.NewReplacer("!", "!!", "%", "!%", "_", "!_").Replace(name)
+	return db.Model(&rpservice.Service{}).Where(
+		"LOWER(domain) IN ? OR LOWER(domain) LIKE ? ESCAPE '!' OR LOWER(domain) LIKE ? ESCAPE '!'",
+		[]string{name, name + "."}, "%."+escaped, "%."+escaped+".",
+	)
+}
diff --git a/management/server/store/sql_store_domain_expiration_test.go b/management/server/store/sql_store_domain_expiration_test.go
new file mode 100644
index 000000000..7dcfb0562
--- /dev/null
+++ b/management/server/store/sql_store_domain_expiration_test.go
@@ -0,0 +1,78 @@
+package store
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/domain"
+	rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
+)
+
+func TestDeleteExpiredCustomDomain_ServiceDependencies(t *testing.T) {
+	runTestForAllEngines(t, "", func(t *testing.T, store Store) {
+		ctx := context.Background()
+		now := time.Now().UTC()
+		db := store.(*SqlStore).db
+		require.NoError(t, store.SaveAccount(ctx, newAccountWithId(ctx, "owner", "admin", "")))
+		for _, tt := range []struct {
+			name        string
+			domainName  string
+			serviceHost string
+			protected   bool
+		}{
+			{"exact", "example.com", "example.com", true},
+			{"subdomain", "example.com", "deep.app.example.com", true},
+			{"case", "example.com", "APP.EXAMPLE.COM.", true},
+			{"suffix-boundary", "example.com", "notexample.com", false},
+			{"literal underscore", "a_b.example.com", "app.a_b.example.com", true},
+			{"underscore wildcard", "a_b.example.com", "app.axb.example.com", false},
+			{"legacy percent wildcard", "a%b.example.com", "app.axxb.example.com", false},
+			{"legacy escape character", "a!b.example.com", "app.ab.example.com", false},
+		} {
+			t.Run(tt.name, func(t *testing.T) {
+				d, err := store.CreateCustomDomain(ctx, "owner", tt.domainName, "cluster", false)
+				require.NoError(t, err)
+				require.NoError(t, db.Model(d).Update("validation_expires_at", now.Add(-time.Hour)).Error)
+				svc := &rpservice.Service{ID: "legacy", AccountID: "owner", Domain: tt.serviceHost}
+				require.NoError(t, store.CreateService(ctx, svc))
+				deleted, err := store.DeleteExpiredCustomDomain(ctx, d, now)
+				if tt.protected {
+					require.Error(t, err)
+					assert.False(t, deleted, "service namespaces must remain reserved")
+				} else {
+					require.NoError(t, err)
+					assert.True(t, deleted, "a hostname outside the namespace must not prevent cleanup")
+				}
+				require.NoError(t, db.Delete(svc).Error)
+				require.NoError(t, db.Delete(d).Error)
+			})
+		}
+	})
+}
+
+func TestDeleteExpiredCustomDomain_RechecksValidation(t *testing.T) {
+	runTestForAllEngines(t, "", func(t *testing.T, store Store) {
+		ctx := context.Background()
+		require.NoError(t, store.SaveAccount(ctx, newAccountWithId(ctx, "owner", "admin", "")))
+		d, err := store.CreateCustomDomain(ctx, "owner", "validated.example.com", "cluster", false)
+		require.NoError(t, err)
+		d, err = store.GetCustomDomain(ctx, "owner", d.ID)
+		require.NoError(t, err)
+		stale := d.Copy()
+		d.Validated = true
+		_, err = store.UpdateCustomDomain(ctx, "owner", d)
+		require.NoError(t, err)
+		deleted, err := store.DeleteExpiredCustomDomain(ctx, stale, time.Now().Add(domain.ValidationTTL))
+		require.NoError(t, err)
+		assert.False(t, deleted, "a stale cleanup candidate must not delete a validated registration")
+		stored, err := store.GetCustomDomain(ctx, "owner", d.ID)
+		require.NoError(t, err)
+		assert.True(t, stored.Validated, "the validated registration must remain usable")
+		require.NotNil(t, stored.ValidationExpiresAt)
+		assert.Equal(t, stale.ValidationExpiresAt, stored.ValidationExpiresAt, "validation must preserve the original deadline")
+	})
+}
diff --git a/management/server/store/sql_store_get_account_test.go b/management/server/store/sql_store_get_account_test.go
index 686839b1f..aca8d8a12 100644
--- a/management/server/store/sql_store_get_account_test.go
+++ b/management/server/store/sql_store_get_account_test.go
@@ -64,7 +64,7 @@ func assertGetAccountLoadsCustomDomains(t *testing.T, store Store) {
 
 	_, err := store.CreateCustomDomain(ctx, accountID, "example.com", "eu.proxy.netbird.io", true)
 	require.NoError(t, err, "creating the first custom domain must succeed")
-	_, err = store.CreateCustomDomain(ctx, accountID, "apps.acme.io", "us.proxy.netbird.io", false)
+	pending, err := store.CreateCustomDomain(ctx, accountID, "apps.acme.io", "us.proxy.netbird.io", false)
 	require.NoError(t, err, "creating the second custom domain must succeed")
 
 	account, err := store.GetAccount(ctx, accountID)
@@ -75,6 +75,10 @@ func assertGetAccountLoadsCustomDomains(t *testing.T, store Store) {
 	for _, d := range account.Domains {
 		require.NotNil(t, d)
 		byDomain[d.Domain] = d.TargetCluster
+		if d.ID == pending.ID {
+			require.NotNil(t, d.ValidationExpiresAt)
+			assert.WithinDuration(t, *pending.ValidationExpiresAt, *d.ValidationExpiresAt, time.Millisecond, "both account loaders must preserve the validation deadline")
+		}
 	}
 	assert.Equal(t, "eu.proxy.netbird.io", byDomain["example.com"], "custom domain must carry its target cluster")
 	assert.Equal(t, "us.proxy.netbird.io", byDomain["apps.acme.io"], "custom domain must carry its target cluster")
diff --git a/management/server/store/sql_store_test.go b/management/server/store/sql_store_test.go
index 4b7bcf068..fbcff5257 100644
--- a/management/server/store/sql_store_test.go
+++ b/management/server/store/sql_store_test.go
@@ -2844,6 +2844,14 @@ func TestSqlStore_GetPeerGroups(t *testing.T) {
 	groups, err = store.GetPeerGroups(context.Background(), LockingStrengthNone, accountID, peerID)
 	require.NoError(t, err)
 	assert.Len(t, groups, 2)
+
+	foreignPeerID := "foreign-peer"
+	err = store.AddPeerToGroup(context.Background(), accountID, foreignPeerID, "cfefqs706sqkneg59g4h")
+	require.NoError(t, err)
+
+	groups, err = store.GetPeerGroups(context.Background(), LockingStrengthNone, "other-account", foreignPeerID)
+	require.NoError(t, err)
+	assert.Empty(t, groups, "groups of another account must not be returned")
 }
 
 func TestSqlStore_GetAccountPeers(t *testing.T) {
@@ -4039,9 +4047,15 @@ func TestSqlStore_GetPeersByGroupIDs(t *testing.T) {
 			}
 			require.NoError(t, store.CreateGroups(ctx, accountID, groups))
 
+			otherAccount := newAccountWithId(ctx, "other-account", "other-user", "")
+			require.NoError(t, store.SaveAccount(ctx, otherAccount))
+			foreignPeer := &nbpeer.Peer{ID: "foreign-peer", AccountID: otherAccount.Id}
+			require.NoError(t, store.AddPeerToAccount(ctx, foreignPeer))
+
 			require.NoError(t, store.AddPeerToGroup(ctx, accountID, peer1, group1ID))
 			require.NoError(t, store.AddPeerToGroup(ctx, accountID, peer2, group1ID))
 			require.NoError(t, store.AddPeerToGroup(ctx, accountID, peer1, group2ID))
+			require.NoError(t, store.AddPeerToGroup(ctx, accountID, foreignPeer.ID, group1ID))
 
 			peers, err := store.GetPeersByGroupIDs(ctx, accountID, tt.groupIDs)
 			require.NoError(t, err)
diff --git a/management/server/store/store.go b/management/server/store/store.go
index 7daeb28a9..6886536b9 100644
--- a/management/server/store/store.go
+++ b/management/server/store/store.go
@@ -302,8 +302,11 @@ type Store interface {
 	GetCustomDomain(ctx context.Context, accountID string, domainID string) (*domain.Domain, error)
 	ListFreeDomains(ctx context.Context, accountID string) ([]string, error)
 	ListCustomDomains(ctx context.Context, accountID string) ([]*domain.Domain, error)
+	GetCustomDomainByName(ctx context.Context, domainName string) (*domain.Domain, error)
 	CreateCustomDomain(ctx context.Context, accountID string, domainName string, targetCluster string, validated bool) (*domain.Domain, error)
 	UpdateCustomDomain(ctx context.Context, accountID string, d *domain.Domain) (*domain.Domain, error)
+	GetExpiredCustomDomains(ctx context.Context, now time.Time, afterID domain.ID, limit int) ([]*domain.Domain, error)
+	DeleteExpiredCustomDomain(ctx context.Context, d *domain.Domain, now time.Time) (bool, error)
 	DeleteCustomDomain(ctx context.Context, accountID string, domainID string) error
 
 	CreateAccessLog(ctx context.Context, log *accesslogs.AccessLogEntry) error
@@ -641,6 +644,9 @@ func migratePostAuto(ctx context.Context, db *gorm.DB) error {
 
 func getMigrationsPostAuto(ctx context.Context) []migrationFunc {
 	return []migrationFunc{
+		func(db *gorm.DB) error {
+			return migration.MigrateCustomDomainValidationExpiry(ctx, db)
+		},
 		func(db *gorm.DB) error {
 			return migration.CreateIndexIfNotExists[nbpeer.Peer](ctx, db, "idx_account_ip", "account_id", "ip")
 		},
diff --git a/management/server/store/store_mock.go b/management/server/store/store_mock.go
index 70acb9f58..04f79d30a 100644
--- a/management/server/store/store_mock.go
+++ b/management/server/store/store_mock.go
@@ -555,6 +555,21 @@ func (mr *MockStoreMockRecorder) DeleteDNSRecord(ctx, accountID, zoneID, recordI
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteDNSRecord", reflect.TypeOf((*MockStore)(nil).DeleteDNSRecord), ctx, accountID, zoneID, recordID)
 }
 
+// DeleteExpiredCustomDomain mocks base method.
+func (m *MockStore) DeleteExpiredCustomDomain(ctx context.Context, d *domain.Domain, now time.Time) (bool, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "DeleteExpiredCustomDomain", ctx, d, now)
+	ret0, _ := ret[0].(bool)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// DeleteExpiredCustomDomain indicates an expected call of DeleteExpiredCustomDomain.
+func (mr *MockStoreMockRecorder) DeleteExpiredCustomDomain(ctx, d, now any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteExpiredCustomDomain", reflect.TypeOf((*MockStore)(nil).DeleteExpiredCustomDomain), ctx, d, now)
+}
+
 // DeleteGroup mocks base method.
 func (m *MockStore) DeleteGroup(ctx context.Context, accountID, groupID string) error {
 	m.ctrl.T.Helper()
@@ -1941,6 +1956,21 @@ func (mr *MockStoreMockRecorder) GetCustomDomain(ctx, accountID, domainID any) *
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetCustomDomain", reflect.TypeOf((*MockStore)(nil).GetCustomDomain), ctx, accountID, domainID)
 }
 
+// GetCustomDomainByName mocks base method.
+func (m *MockStore) GetCustomDomainByName(ctx context.Context, domainName string) (*domain.Domain, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetCustomDomainByName", ctx, domainName)
+	ret0, _ := ret[0].(*domain.Domain)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetCustomDomainByName indicates an expected call of GetCustomDomainByName.
+func (mr *MockStoreMockRecorder) GetCustomDomainByName(ctx, domainName any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetCustomDomainByName", reflect.TypeOf((*MockStore)(nil).GetCustomDomainByName), ctx, domainName)
+}
+
 // GetCustomDomainsCounts mocks base method.
 func (m *MockStore) GetCustomDomainsCounts(ctx context.Context) (int64, int64, error) {
 	m.ctrl.T.Helper()
@@ -1987,6 +2017,21 @@ func (mr *MockStoreMockRecorder) GetEmbeddedProxyPeerIDsByCluster(ctx, accountID
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetEmbeddedProxyPeerIDsByCluster", reflect.TypeOf((*MockStore)(nil).GetEmbeddedProxyPeerIDsByCluster), ctx, accountID)
 }
 
+// GetExpiredCustomDomains mocks base method.
+func (m *MockStore) GetExpiredCustomDomains(ctx context.Context, now time.Time, afterID domain.ID, limit int) ([]*domain.Domain, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetExpiredCustomDomains", ctx, now, afterID, limit)
+	ret0, _ := ret[0].([]*domain.Domain)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetExpiredCustomDomains indicates an expected call of GetExpiredCustomDomains.
+func (mr *MockStoreMockRecorder) GetExpiredCustomDomains(ctx, now, afterID, limit any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetExpiredCustomDomains", reflect.TypeOf((*MockStore)(nil).GetExpiredCustomDomains), ctx, now, afterID, limit)
+}
+
 // GetExpiredEphemeralServices mocks base method.
 func (m *MockStore) GetExpiredEphemeralServices(ctx context.Context, ttl time.Duration, limit int) ([]*service.Service, error) {
 	m.ctrl.T.Helper()
diff --git a/management/server/types/account.go b/management/server/types/account.go
index d689b0175..d0688d1ee 100644
--- a/management/server/types/account.go
+++ b/management/server/types/account.go
@@ -404,7 +404,7 @@ func (a *Account) GetExpiredPeers() []*nbpeer.Peer {
 
 // GetNextPeerExpiration returns the minimum duration in which the next peer of the account will expire if it was found.
 // If there is no peer that expires this function returns false and a duration of 0.
-// This function only considers peers that haven't been expired yet and that are connected.
+// This function only considers peers that haven't been expired yet, whether connected or not.
 func (a *Account) GetNextPeerExpiration() (time.Duration, bool) {
 	peersWithExpiry := a.GetPeersWithExpiration()
 	if len(peersWithExpiry) == 0 {
@@ -412,8 +412,7 @@ func (a *Account) GetNextPeerExpiration() (time.Duration, bool) {
 	}
 	var nextExpiry *time.Duration
 	for _, peer := range peersWithExpiry {
-		// consider only connected peers because others will require login on connecting to the management server
-		if peer.Status.LoginExpired || !peer.Status.Connected {
+		if peer.Status.LoginExpired {
 			continue
 		}
 		_, duration := peer.LoginExpired(a.Settings.PeerLoginExpiration)
diff --git a/management/server/types/identity_provider.go b/management/server/types/identity_provider.go
index 0c1f9509c..f75b5319d 100644
--- a/management/server/types/identity_provider.go
+++ b/management/server/types/identity_provider.go
@@ -3,6 +3,7 @@ package types
 import (
 	"errors"
 	"net/url"
+	"strings"
 )
 
 // Identity provider validation errors
@@ -99,7 +100,16 @@ func (idp *IdentityProvider) Validate() error {
 	}
 	if idp.Issuer != "" {
 		parsedURL, err := url.Parse(idp.Issuer)
-		if err != nil || parsedURL.Scheme == "" || parsedURL.Host == "" {
+		if err != nil || parsedURL.Host == "" {
+			return ErrIdentityProviderIssuerInvalid
+		}
+		if parsedURL.Scheme != "https" {
+			return ErrIdentityProviderIssuerInvalid
+		}
+		if parsedURL.User != nil {
+			return ErrIdentityProviderIssuerInvalid
+		}
+		if strings.ContainsAny(idp.Issuer, "?#") {
 			return ErrIdentityProviderIssuerInvalid
 		}
 	}
diff --git a/management/server/types/identity_provider_test.go b/management/server/types/identity_provider_test.go
index 6ddc563f2..53385c5ac 100644
--- a/management/server/types/identity_provider_test.go
+++ b/management/server/types/identity_provider_test.go
@@ -135,3 +135,54 @@ func TestIdentityProvider_Validate(t *testing.T) {
 		})
 	}
 }
+
+func TestIdentityProvider_ValidateRejectsNonOriginIssuers(t *testing.T) {
+	issuers := []string{
+		"https://idp.example.com/realms/nb?foo=bar",
+		"https://idp.example.com/realms/nb#section",
+		"https://user:pass@idp.example.com",
+		"ftp://idp.example.com",
+		"ldap://idp.example.com",
+		"http://idp.example.com",
+	}
+
+	for _, issuer := range issuers {
+		t.Run(issuer, func(t *testing.T) {
+			idp := &IdentityProvider{
+				Name:     "test",
+				Type:     IdentityProviderTypeOIDC,
+				Issuer:   issuer,
+				ClientID: "client-id",
+			}
+			assert.ErrorIs(t, idp.Validate(), ErrIdentityProviderIssuerInvalid)
+		})
+	}
+}
+
+func TestIdentityProvider_ValidateAcceptsOriginAndPath(t *testing.T) {
+	for _, issuer := range []string{"https://idp.example.com", "https://idp.example.com/realms/nb", "https://127.0.0.1:5556/dex"} {
+		t.Run(issuer, func(t *testing.T) {
+			idp := &IdentityProvider{
+				Name:     "test",
+				Type:     IdentityProviderTypeOIDC,
+				Issuer:   issuer,
+				ClientID: "client-id",
+			}
+			assert.NoError(t, idp.Validate())
+		})
+	}
+}
+
+func TestIdentityProviderValidateRejectsBareDelimiters(t *testing.T) {
+	for _, issuer := range []string{"https://idp.example.com/realms/nb?", "https://idp.example.com/realms/nb#"} {
+		t.Run(issuer, func(t *testing.T) {
+			idp := &IdentityProvider{
+				Name:     "test",
+				Type:     IdentityProviderTypeOIDC,
+				Issuer:   issuer,
+				ClientID: "client-id",
+			}
+			assert.ErrorIs(t, idp.Validate(), ErrIdentityProviderIssuerInvalid)
+		})
+	}
+}
diff --git a/management/server/user.go b/management/server/user.go
index 7c0a3088d..823c1b2e4 100644
--- a/management/server/user.go
+++ b/management/server/user.go
@@ -1177,28 +1177,35 @@ func (am *DefaultAccountManager) expireAndUpdatePeers(ctx context.Context, accou
 	dnsDomain := am.networkMapController.GetDNSDomain(settings)
 
 	var peerIDs []string
-	for _, peer := range peers {
+	defer func() {
+		if len(peerIDs) == 0 {
+			return
+		}
+		// this will trigger peer disconnect from the management service
+		log.Debugf("Expiring %d peers for account %s", len(peerIDs), accountID)
+		am.networkMapController.DisconnectPeers(ctx, accountID, peerIDs)
+	}()
+	for _, candidate := range peers {
 		// nolint:staticcheck
-		ctx = context.WithValue(ctx, nbcontext.PeerIDKey, peer.Key)
+		peerCtx := context.WithValue(ctx, nbcontext.PeerIDKey, candidate.Key)
 
-		if peer.UserID == "" {
+		if candidate.UserID == "" {
 			// we do not want to expire peers that are added via setup key
 			continue
 		}
 
-		if peer.Status.LoginExpired {
+		peer, err := am.expirePeerIfStillDue(peerCtx, accountID, candidate.ID, settings, reason)
+		if err != nil {
+			return err
+		}
+		if peer == nil {
 			continue
 		}
 		peerIDs = append(peerIDs, peer.ID)
-		peer.MarkLoginExpired(true)
-
-		if err := am.Store.SavePeerStatus(ctx, accountID, peer.ID, *peer.Status); err != nil {
-			return err
-		}
 		meta := peer.EventMeta(dnsDomain)
 		meta["reason"] = string(reason)
 		am.StoreEvent(
-			ctx,
+			peerCtx,
 			peer.UserID, peer.ID, accountID,
 			activity.PeerLoginExpired, meta,
 		)
@@ -1215,15 +1222,53 @@ func (am *DefaultAccountManager) expireAndUpdatePeers(ctx context.Context, accou
 	if err != nil {
 		return fmt.Errorf("notify network map controller of peer update: %w", err)
 	}
-
-	if len(peerIDs) != 0 {
-		// this will trigger peer disconnect from the management service
-		log.Debugf("Expiring %d peers for account %s", len(peerIDs), accountID)
-		am.networkMapController.DisconnectPeers(ctx, accountID, peerIDs)
-	}
 	return nil
 }
 
+// expirePeerIfStillDue flags the peer as login-expired and returns its fresh copy, or nil
+// when it no longer qualifies. The candidate list is read without a lock, so a login that
+// landed in between would otherwise be overwritten with a stale expired status.
+func (am *DefaultAccountManager) expirePeerIfStillDue(ctx context.Context, accountID, peerID string, settings *types.Settings, reason peerExpirationReason) (*nbpeer.Peer, error) {
+	var expired *nbpeer.Peer
+	err := am.Store.ExecuteInTransaction(ctx, func(transaction store.Store) error {
+		peer, err := transaction.GetPeerByID(ctx, store.LockingStrengthUpdate, accountID, peerID)
+		if err != nil {
+			if s, ok := status.FromError(err); ok && s.Type() == status.NotFound {
+				return nil
+			}
+			return err
+		}
+		if peer.Status.LoginExpired || !peerExpirationDue(peer, settings, reason) {
+			return nil
+		}
+		peer.MarkLoginExpired(true)
+		if err := transaction.SavePeerStatus(ctx, accountID, peer.ID, *peer.Status); err != nil {
+			return err
+		}
+		expired = peer
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+	return expired, nil
+}
+
+// peerExpirationDue re-evaluates a time-based expiry against the peer's current state.
+// Administrative reasons expire the peer unconditionally.
+func peerExpirationDue(peer *nbpeer.Peer, settings *types.Settings, reason peerExpirationReason) bool {
+	switch reason {
+	case peerExpirationSessionExpired:
+		expired, _ := peer.LoginExpired(settings.PeerLoginExpiration)
+		return settings.PeerLoginExpirationEnabled && expired
+	case peerExpirationInactivity:
+		expired, _ := peer.SessionExpired(settings.PeerInactivityExpiration)
+		return settings.PeerInactivityExpirationEnabled && expired
+	default:
+		return true
+	}
+}
+
 func (am *DefaultAccountManager) deleteUserFromIDP(ctx context.Context, targetUserID, accountID string) error {
 	if am.userDeleteFromIDPEnabled {
 		log.WithContext(ctx).Debugf("user %s deleted from IdP", targetUserID)
@@ -1337,6 +1382,10 @@ func (am *DefaultAccountManager) deleteRegularUser(ctx context.Context, accountI
 			return fmt.Errorf("failed to get user to delete: %w", err)
 		}
 
+		if targetUser.Role == types.UserRoleOwner && targetUser.Id != initiatorUserID {
+			return status.NewOwnerDeletePermissionError()
+		}
+
 		settings, err = transaction.GetAccountSettings(ctx, store.LockingStrengthNone, accountID)
 		if err != nil {
 			return fmt.Errorf("failed to get account settings: %w", err)
diff --git a/management/server/user_test.go b/management/server/user_test.go
index 3a2414540..ec0bbc54e 100644
--- a/management/server/user_test.go
+++ b/management/server/user_test.go
@@ -942,6 +942,49 @@ func TestUser_DeleteUser_regularUser(t *testing.T) {
 
 }
 
+func TestUser_deleteRegularUser_RejectsOwner(t *testing.T) {
+	s, cleanup, err := store.NewTestStoreFromSQL(context.Background(), "", t.TempDir())
+	require.NoError(t, err)
+	t.Cleanup(cleanup)
+
+	account := newAccountWithId(context.Background(), mockAccountID, mockUserID, "", "", "", false)
+	account.Users[mockTargetUserId] = &types.User{
+		Id:     mockTargetUserId,
+		Issued: types.UserIssuedAPI,
+		Role:   types.UserRoleOwner,
+	}
+	require.NoError(t, s.SaveAccount(context.Background(), account))
+
+	am := DefaultAccountManager{Store: s}
+
+	_, err = am.deleteRegularUser(context.Background(), mockAccountID, mockUserID, &types.UserInfo{ID: mockTargetUserId})
+	assert.EqualError(t, err, status.NewOwnerDeletePermissionError().Error())
+}
+
+func TestUser_deleteRegularUser_InitiatorOwnerDeletesThemself(t *testing.T) {
+	s, cleanup, err := store.NewTestStoreFromSQL(context.Background(), "", t.TempDir())
+	require.NoError(t, err)
+	t.Cleanup(cleanup)
+
+	account := newAccountWithId(context.Background(), mockAccountID, mockUserID, "", "", "", false)
+	require.NoError(t, s.SaveAccount(context.Background(), account))
+
+	networkMapControllerMock := network_map.NewMockController(gomock.NewController(t))
+	networkMapControllerMock.EXPECT().OnPeersDeleted(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).Return(nil)
+
+	am := DefaultAccountManager{
+		Store:                s,
+		eventStore:           &activity.InMemoryEventStore{},
+		networkMapController: networkMapControllerMock,
+	}
+
+	_, err = am.deleteRegularUser(context.Background(), mockAccountID, mockUserID, &types.UserInfo{ID: mockUserID})
+	require.NoError(t, err)
+
+	_, err = s.GetUserByUserID(context.Background(), store.LockingStrengthNone, mockUserID)
+	assert.Equal(t, status.NewUserNotFoundError(mockUserID), err)
+}
+
 func TestUser_DeleteUser_RegularUsers(t *testing.T) {
 	store, cleanup, err := store.NewTestStoreFromSQL(context.Background(), "", t.TempDir())
 	if err != nil {
diff --git a/proxy/internal/acme/locker.go b/proxy/internal/acme/locker.go
index 2f0f18885..f42324736 100644
--- a/proxy/internal/acme/locker.go
+++ b/proxy/internal/acme/locker.go
@@ -2,12 +2,14 @@ package acme
 
 import (
 	"context"
+	"fmt"
 	"path/filepath"
 
 	log "github.com/sirupsen/logrus"
 
 	"github.com/netbirdio/netbird/proxy/internal/flock"
 	"github.com/netbirdio/netbird/proxy/internal/k8s"
+	"github.com/netbirdio/netbird/shared/management/domain"
 )
 
 // certLocker provides distributed mutual exclusion for certificate operations.
@@ -74,9 +76,15 @@ func newFlockLocker(certDir string, logger *log.Logger) *flockLocker {
 	return &flockLocker{certDir: certDir, logger: logger}
 }
 
-// Lock acquires an advisory file lock for the given domain.
-func (l *flockLocker) Lock(ctx context.Context, domain string) (func(), error) {
-	lockPath := filepath.Join(l.certDir, domain+".lock")
+// Lock acquires an advisory file lock for the given domain. The domain must
+// be a valid hostname so the lock file always resolves to a direct child of
+// certDir; anything else is rejected before touching the filesystem.
+func (l *flockLocker) Lock(ctx context.Context, name string) (func(), error) {
+	if !domain.IsValidDomainNoWildcard(name) {
+		return nil, fmt.Errorf("invalid domain %q for lock file", name)
+	}
+
+	lockPath := filepath.Join(l.certDir, name+".lock")
 	lockFile, err := flock.Lock(ctx, lockPath)
 	if err != nil {
 		return nil, err
@@ -89,7 +97,7 @@ func (l *flockLocker) Lock(ctx context.Context, domain string) (func(), error) {
 
 	return func() {
 		if err := flock.Unlock(lockFile); err != nil {
-			l.logger.Debugf("release cert lock for domain %q: %v", domain, err)
+			l.logger.Debugf("release cert lock for domain %q: %v", name, err)
 		}
 	}, nil
 }
diff --git a/proxy/internal/acme/locker_test.go b/proxy/internal/acme/locker_test.go
index 39245df0c..f131f64f3 100644
--- a/proxy/internal/acme/locker_test.go
+++ b/proxy/internal/acme/locker_test.go
@@ -63,3 +63,33 @@ func TestNewCertLockerK8sFallsBackToFlock(t *testing.T) {
 	_, ok := locker.(*flockLocker)
 	assert.True(t, ok, "k8s-lease without SA should fall back to flockLocker")
 }
+
+func TestFlockLockerRejectsUnsafeDomain(t *testing.T) {
+	root := t.TempDir()
+	certDir := filepath.Join(root, "certs")
+	require.NoError(t, os.Mkdir(certDir, 0o700))
+	locker := newFlockLocker(certDir, nil)
+
+	for _, d := range []string{
+		"",
+		".",
+		"..",
+		"../escape",
+		"../../etc/cron.d/attacker",
+		"sub/dir.example.com",
+		`back\slash.example.com`,
+		"*.example.com",
+	} {
+		unlock, err := locker.Lock(context.Background(), d)
+		assert.Error(t, err, "domain %q", d)
+		assert.Nil(t, unlock, "domain %q", d)
+	}
+
+	assert.NoFileExists(t, filepath.Join(root, "escape.lock"))
+	certEntries, err := os.ReadDir(certDir)
+	require.NoError(t, err)
+	assert.Empty(t, certEntries)
+	rootEntries, err := os.ReadDir(root)
+	require.NoError(t, err)
+	assert.Len(t, rootEntries, 1)
+}
diff --git a/proxy/internal/debug/handler.go b/proxy/internal/debug/handler.go
index 6300228d7..960c3e089 100644
--- a/proxy/internal/debug/handler.go
+++ b/proxy/internal/debug/handler.go
@@ -105,6 +105,20 @@ type Handler struct {
 	startTime  time.Time
 	templates  *template.Template
 	templateMu sync.RWMutex
+
+	// setPerformance applies a buffer cap to one client. Held as a field so
+	// tests can drive applyBufferCap without a live embedded client.
+	setPerformance func(*nbembed.Client, uint32) error
+
+	perfMu       sync.Mutex
+	perfInflight map[types.AccountID]*perfWorker
+}
+
+// perfWorker is the single in-flight retune for one account. err is valid once
+// done is closed.
+type perfWorker struct {
+	done chan struct{}
+	err  error
 }
 
 // NewHandler creates a new debug handler.
@@ -113,10 +127,11 @@ func NewHandler(provider clientProvider, healthChecker healthChecker, logger *lo
 		logger = log.StandardLogger()
 	}
 	h := &Handler{
-		provider:  provider,
-		health:    healthChecker,
-		logger:    logger,
-		startTime: time.Now(),
+		provider:       provider,
+		health:         healthChecker,
+		logger:         logger,
+		startTime:      time.Now(),
+		setPerformance: setClientPerformance,
 	}
 	if err := h.loadTemplates(); err != nil {
 		logger.Errorf("failed to load embedded templates: %v", err)
@@ -716,15 +731,7 @@ func (h *Handler) handlePerf(w http.ResponseWriter, r *http.Request) {
 	}
 
 	capN := uint32(n)
-	applied := 0
-	failed := map[string]string{}
-	for accountID, client := range h.provider.ListClientsForStartup() {
-		if err := client.SetPerformance(nbembed.Performance{PreallocatedBuffersPerPool: &capN}); err != nil {
-			failed[string(accountID)] = err.Error()
-			continue
-		}
-		applied++
-	}
+	applied, failed, inFlight := h.applyBufferCap(capN)
 
 	resp := map[string]any{
 		"success": true,
@@ -734,9 +741,165 @@ func (h *Handler) handlePerf(w http.ResponseWriter, r *http.Request) {
 	if len(failed) > 0 {
 		resp["failed"] = failed
 	}
+	if len(inFlight) > 0 {
+		resp["in_flight"] = inFlight
+	}
 	h.writeJSON(w, resp)
 }
 
+// perfApplyTimeout bounds the whole apply, however many clients are registered.
+// A var, not a const, so tests can shorten the wait.
+var perfApplyTimeout = 5 * time.Second
+
+type perfResult struct {
+	accountID types.AccountID
+	err       error
+}
+
+// setClientPerformance is the production implementation behind Handler.setPerformance.
+func setClientPerformance(client *nbembed.Client, capN uint32) error {
+	return client.SetPerformance(nbembed.Performance{PreallocatedBuffersPerPool: &capN})
+}
+
+// collectBuffered takes every result already sitting in the channel, removing
+// those accounts from pending, and returns how many of them succeeded. It is
+// called when the deadline fires: select picks at random among ready cases, so
+// a result that landed in time would otherwise be reported as a timeout.
+func collectBuffered(results <-chan perfResult, pending map[types.AccountID]*perfWorker, failed map[string]string) int {
+	applied := 0
+	for {
+		select {
+		case res := <-results:
+			delete(pending, res.accountID)
+			if res.err != nil {
+				failed[string(res.accountID)] = res.err.Error()
+				continue
+			}
+			applied++
+		default:
+			return applied
+		}
+	}
+}
+
+// resolvePending closes out the accounts still pending when the deadline fires.
+// A worker whose done channel is closed has finished, whatever the results
+// channel has managed to deliver, so its own error is the truth; the rest are
+// genuinely still running and are reported as timed out. Returns how many of
+// them had in fact succeeded.
+func resolvePending(pending map[types.AccountID]*perfWorker, failed map[string]string) int {
+	applied := 0
+	for accountID, w := range pending {
+		select {
+		case <-w.done:
+			if w.err != nil {
+				failed[string(accountID)] = w.err.Error()
+				continue
+			}
+			applied++
+		default:
+			failed[string(accountID)] = fmt.Sprintf("timed out after %s waiting for the client", perfApplyTimeout)
+		}
+	}
+	return applied
+}
+
+// startPerfWorker returns the in-flight retune for the account, starting one if
+// there is none. The bool reports whether this call started it.
+//
+// At most one retune runs per account at a time. A client wedged inside its own
+// lock never returns, so without this a caller could add one permanently blocked
+// goroutine per request just by retrying the endpoint.
+func (h *Handler) startPerfWorker(accountID types.AccountID, client *nbembed.Client, capN uint32, results chan<- perfResult) (*perfWorker, bool) {
+	h.perfMu.Lock()
+	defer h.perfMu.Unlock()
+
+	if w, ok := h.perfInflight[accountID]; ok {
+		return w, false
+	}
+
+	w := &perfWorker{done: make(chan struct{})}
+	if h.perfInflight == nil {
+		h.perfInflight = make(map[types.AccountID]*perfWorker)
+	}
+	h.perfInflight[accountID] = w
+
+	go func() {
+		err := h.setPerformance(client, capN)
+		w.err = err
+		close(w.done)
+
+		// Publish before touching the registry: perfMu is taken once per
+		// account by every caller walking the fleet, so a finishing worker
+		// can queue behind a long apply and miss its own deadline.
+		results <- perfResult{accountID: accountID, err: err}
+
+		h.perfMu.Lock()
+		delete(h.perfInflight, accountID)
+		h.perfMu.Unlock()
+	}()
+
+	return w, true
+}
+
+// applyBufferCap sets the WireGuard buffer pool cap on every registered client
+// and reports how many took it, a per-account error for those that did not, and
+// the accounts whose earlier retune has not come back yet.
+//
+// Clients are handled concurrently and the wait is bounded: SetPerformance goes
+// through the embedded client's lock, which Start and Stop hold for as long as
+// they take - and on a wedged client Stop never returns. This endpoint is the
+// recovery path for exactly that fleet, so one stuck account must neither delay
+// the others nor accumulate goroutines across retries.
+func (h *Handler) applyBufferCap(capN uint32) (int, map[string]string, []string) {
+	clients := h.provider.ListClientsForStartup()
+	results := make(chan perfResult, len(clients))
+
+	applied := 0
+	failed := map[string]string{}
+	var inFlight []string
+	pending := make(map[types.AccountID]*perfWorker, len(clients))
+
+	for accountID, client := range clients {
+		w, started := h.startPerfWorker(accountID, client, capN, results)
+		if started {
+			pending[accountID] = w
+			continue
+		}
+		// Another request owns this account's retune. Take its result if it
+		// has already landed, otherwise report it as still running instead of
+		// waiting on it again.
+		select {
+		case <-w.done:
+			if w.err != nil {
+				failed[string(accountID)] = w.err.Error()
+				continue
+			}
+			applied++
+		default:
+			inFlight = append(inFlight, string(accountID))
+		}
+	}
+
+	deadline := time.After(perfApplyTimeout)
+	for range len(pending) {
+		select {
+		case res := <-results:
+			delete(pending, res.accountID)
+			if res.err != nil {
+				failed[string(res.accountID)] = res.err.Error()
+				continue
+			}
+			applied++
+		case <-deadline:
+			applied += collectBuffered(results, pending, failed)
+			applied += resolvePending(pending, failed)
+			return applied, failed, inFlight
+		}
+	}
+	return applied, failed, inFlight
+}
+
 // handleRuntime returns cheap runtime and process stats. Safe to hit on a
 // running proxy; does not read pprof profiles.
 func (h *Handler) handleRuntime(w http.ResponseWriter, _ *http.Request) {
diff --git a/proxy/internal/debug/perf_test.go b/proxy/internal/debug/perf_test.go
new file mode 100644
index 000000000..abcfccb50
--- /dev/null
+++ b/proxy/internal/debug/perf_test.go
@@ -0,0 +1,158 @@
+package debug
+
+import (
+	"context"
+	"errors"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	nbembed "github.com/netbirdio/netbird/client/embed"
+	"github.com/netbirdio/netbird/proxy/internal/health"
+	"github.com/netbirdio/netbird/proxy/internal/roundtrip"
+	"github.com/netbirdio/netbird/proxy/internal/types"
+)
+
+// perfProvider serves a fixed set of accounts. The clients are nil: the tests
+// drive Handler.setPerformance, which never dereferences them.
+type perfProvider struct {
+	accounts []types.AccountID
+}
+
+func (p *perfProvider) GetClient(types.AccountID) (*nbembed.Client, bool) { return nil, false }
+
+func (p *perfProvider) ListClientsForDebug() map[types.AccountID]roundtrip.ClientDebugInfo {
+	return nil
+}
+
+func (p *perfProvider) ListClientsForStartup() map[types.AccountID]*nbembed.Client {
+	out := make(map[types.AccountID]*nbembed.Client, len(p.accounts))
+	for _, id := range p.accounts {
+		out[id] = nil
+	}
+	return out
+}
+
+type stubHealth struct{}
+
+func (stubHealth) ReadinessProbe() bool              { return true }
+func (stubHealth) StartupProbe(context.Context) bool { return true }
+func (stubHealth) CheckClientsConnected(context.Context) (bool, map[types.AccountID]health.ClientHealth) {
+	return true, nil
+}
+
+func shortenPerfTimeout(t *testing.T, d time.Duration) {
+	t.Helper()
+	prev := perfApplyTimeout
+	perfApplyTimeout = d
+	t.Cleanup(func() { perfApplyTimeout = prev })
+}
+
+// TestCollectBufferedCountsResultsReadyAtTheDeadline covers the select-ordering
+// trap: when the deadline fires, results already buffered must be counted, not
+// reported as timeouts. Driving collectBuffered directly keeps it deterministic
+// - through applyBufferCap the two select cases race by construction.
+func TestCollectBufferedCountsResultsReadyAtTheDeadline(t *testing.T) {
+	results := make(chan perfResult, 3)
+	results <- perfResult{accountID: "ok"}
+	results <- perfResult{accountID: "broken", err: errors.New("boom")}
+
+	pending := map[types.AccountID]*perfWorker{
+		"ok":     {done: make(chan struct{})},
+		"broken": {done: make(chan struct{})},
+		"wedged": {done: make(chan struct{})},
+	}
+	failed := map[string]string{}
+
+	applied := collectBuffered(results, pending, failed)
+
+	if applied != 1 {
+		t.Fatalf("applied = %d, want 1", applied)
+	}
+	if failed["broken"] != "boom" {
+		t.Fatalf("failed = %v, want the error recorded for \"broken\"", failed)
+	}
+	if _, ok := pending["wedged"]; !ok || len(pending) != 1 {
+		t.Fatalf("pending = %v, want only the account that never answered", pending)
+	}
+}
+
+// TestApplyBufferCapSingleFlightPerAccount covers the goroutine accumulation
+// reported on PR #7452: repeated calls against a client stuck in its own lock
+// must not start a second attempt for the same account.
+func TestApplyBufferCapSingleFlightPerAccount(t *testing.T) {
+	shortenPerfTimeout(t, 50*time.Millisecond)
+
+	release := make(chan struct{})
+	t.Cleanup(func() { close(release) })
+
+	var calls atomic.Int32
+	h := &Handler{
+		provider: &perfProvider{accounts: []types.AccountID{"wedged"}},
+		health:   stubHealth{},
+		setPerformance: func(_ *nbembed.Client, _ uint32) error {
+			calls.Add(1)
+			<-release
+			return nil
+		},
+	}
+
+	for i := range 5 {
+		applied, failed, inFlight := h.applyBufferCap(4096)
+		if applied != 0 {
+			t.Fatalf("call %d: applied = %d, want 0", i, applied)
+		}
+		if i == 0 {
+			if len(failed) != 1 {
+				t.Fatalf("first call: failed = %v, want the account reported as timed out", failed)
+			}
+			continue
+		}
+		if len(inFlight) != 1 {
+			t.Fatalf("call %d: inFlight = %v, want the account reported as still running", i, inFlight)
+		}
+		if len(failed) != 0 {
+			t.Fatalf("call %d: failed = %v, want empty while the retune is in flight", i, failed)
+		}
+	}
+
+	if got := calls.Load(); got != 1 {
+		t.Fatalf("setPerformance called %d times, want 1: each retry started another blocked worker", got)
+	}
+}
+
+// TestResolvePendingTrustsFinishedWorkers covers the reporting race cubic
+// flagged on PR #7452: a retune that finished just before the deadline must be
+// reported by its outcome, not as a timeout, whatever the results channel has
+// delivered so far.
+func TestResolvePendingTrustsFinishedWorkers(t *testing.T) {
+	ok := &perfWorker{done: make(chan struct{})}
+	close(ok.done)
+
+	broken := &perfWorker{done: make(chan struct{}), err: errors.New("boom")}
+	close(broken.done)
+
+	stillRunning := &perfWorker{done: make(chan struct{})}
+
+	pending := map[types.AccountID]*perfWorker{
+		"ok":      ok,
+		"broken":  broken,
+		"running": stillRunning,
+	}
+	failed := map[string]string{}
+
+	applied := resolvePending(pending, failed)
+
+	if applied != 1 {
+		t.Fatalf("applied = %d, want 1", applied)
+	}
+	if failed["broken"] != "boom" {
+		t.Fatalf("failed[broken] = %q, want the worker's own error", failed["broken"])
+	}
+	if _, ok := failed["ok"]; ok {
+		t.Fatalf("failed = %v, want no entry for the account that succeeded", failed)
+	}
+	if got := failed["running"]; got == "" || got == "boom" {
+		t.Fatalf("failed[running] = %q, want the timeout message", got)
+	}
+}
diff --git a/shared/relay/client/client.go b/shared/relay/client/client.go
index 38c9c7375..7171b40ad 100644
--- a/shared/relay/client/client.go
+++ b/shared/relay/client/client.go
@@ -279,7 +279,7 @@ func (c *Client) Connect(ctx context.Context) error {
 	c.stateSubscription = NewPeersStateSubscription(c.log, c.relayConn, c.closeConnsByPeerID)
 
 	c.log = c.log.WithField("relay", instanceURL.String())
-	c.log.Infof("relay connection established")
+	c.log.Infof("relay connection established, server IP: %s", connectedIP(c.relayConn))
 
 	c.serviceIsRunning = true
 
@@ -364,23 +364,6 @@ func (c *Client) ServerInstanceURL() (string, error) {
 	return c.instanceURL.String(), nil
 }
 
-// ConnectedIP returns the IP address of the live relay-server connection,
-// extracted from the underlying socket's RemoteAddr. Zero value if not
-// connected or if the address is not an IP literal.
-func (c *Client) ConnectedIP() netip.Addr {
-	c.mu.Lock()
-	conn := c.relayConn
-	c.mu.Unlock()
-	if conn == nil {
-		return netip.Addr{}
-	}
-	addr := conn.RemoteAddr()
-	if addr == nil {
-		return netip.Addr{}
-	}
-	return extractIPLiteral(addr.String())
-}
-
 // SetOnDisconnectListener sets a function that will be called when the connection to the relay server is closed.
 func (c *Client) SetOnDisconnectListener(fn func(string)) {
 	c.listenerMutex.Lock()
@@ -777,6 +760,17 @@ func (c *Client) listenForStopEvents(ctx context.Context, hc *healthcheck.Receiv
 	}
 }
 
+func (c *Client) serverInstanceAddress() (string, netip.Addr, error) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	addr, err := c.ServerInstanceURL()
+	if err != nil {
+		return "", netip.Addr{}, err
+	}
+	return addr, connectedIP(c.relayConn), nil
+}
+
 func (c *Client) closeAllConns() {
 	for _, container := range c.conns {
 		container.close()
@@ -923,6 +917,17 @@ func (c *Client) handlePeersWentOfflineMsg(buf []byte) {
 	c.stateSubscription.OnPeersWentOffline(peersID)
 }
 
+func connectedIP(conn net.Conn) netip.Addr {
+	if conn == nil {
+		return netip.Addr{}
+	}
+	addr := conn.RemoteAddr()
+	if addr == nil {
+		return netip.Addr{}
+	}
+	return extractIPLiteral(addr.String())
+}
+
 // extractIPLiteral returns the IP from address forms produced by the relay
 // dialers (URL or host:port). Zero value if the host is not an IP.
 func extractIPLiteral(s string) netip.Addr {
diff --git a/shared/relay/client/client_serverip_test.go b/shared/relay/client/client_serverip_test.go
index 7e699e37d..a52d434f7 100644
--- a/shared/relay/client/client_serverip_test.go
+++ b/shared/relay/client/client_serverip_test.go
@@ -8,6 +8,8 @@ import (
 	"testing"
 	"time"
 
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 	"go.opentelemetry.io/otel"
 
 	"github.com/netbirdio/netbird/client/iface"
@@ -68,18 +70,17 @@ func TestClient_ServerIPRecoversFromUnresolvableFQDN(t *testing.T) {
 		if !c.Ready() {
 			t.Fatalf("client not ready after connect")
 		}
-		if got := c.ConnectedIP(); got.String() != "127.0.0.1" {
-			t.Fatalf("ConnectedIP = %q, want 127.0.0.1", got)
-		}
+		url, ip, err := c.serverInstanceAddress()
+		require.NoError(t, err)
+		assert.Equal(t, srvCfg.ExposedAddress, url, "relay URL must come from the handshake")
+		assert.Equal(t, netip.MustParseAddr("127.0.0.1"), ip, "relay IP must come from the connection")
 	})
 }
 
-// TestClient_ConnectedIPAfterFQDNDial verifies ConnectedIP returns the
-// resolved IP after a successful FQDN-based dial. The underlying socket's
-// RemoteAddr must be exposed through the dialer wrappers; if it returns
-// the dial-time URL instead, ConnectedIP returns empty and the dial
-// IP we advertise to peers is empty too.
-func TestClient_ConnectedIPAfterFQDNDial(t *testing.T) {
+// TestClient_ServerInstanceAddressAfterFQDNDial verifies the relay address
+// includes the resolved IP after an FQDN dial. The dialer wrappers must expose
+// the socket's RemoteAddr; returning the dial-time URL would lose the IP.
+func TestClient_ServerInstanceAddressAfterFQDNDial(t *testing.T) {
 	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
 	defer cancel()
 
@@ -111,10 +112,10 @@ func TestClient_ConnectedIPAfterFQDNDial(t *testing.T) {
 	}
 	t.Cleanup(func() { _ = c.Close() })
 
-	got := c.ConnectedIP().String()
-	if got != "127.0.0.1" && got != "::1" {
-		t.Fatalf("ConnectedIP after FQDN dial = %q, want 127.0.0.1 or ::1", got)
-	}
+	url, ip, err := c.serverInstanceAddress()
+	require.NoError(t, err)
+	assert.Equal(t, srvCfg.ExposedAddress, url, "relay URL must come from the handshake")
+	assert.Contains(t, []string{"127.0.0.1", "::1"}, ip.String(), "relay IP must resolve to localhost")
 }
 
 func TestSubstituteHost(t *testing.T) {
@@ -214,15 +215,12 @@ func TestSubstituteHost(t *testing.T) {
 	}
 }
 
-func TestClient_ConnectedIPEmptyWhenNotConnected(t *testing.T) {
-	c := NewClient("rel://example.invalid:80", hmacTokenStore, "x", iface.DefaultMTU)
-	if got := c.ConnectedIP(); got.IsValid() {
-		t.Fatalf("ConnectedIP on disconnected client = %q, want zero", got)
-	}
+func TestConnectedIPNilConnection(t *testing.T) {
+	assert.False(t, connectedIP(nil).IsValid(), "missing connection must not provide an IP")
 }
 
 // staticAddr is a net.Addr that returns a fixed string. Used to verify
-// ConnectedIP parses RemoteAddr correctly.
+// connectedIP parses RemoteAddr correctly.
 type staticAddr struct{ s string }
 
 func (a staticAddr) Network() string { return "tcp" }
@@ -235,7 +233,7 @@ type stubConn struct {
 
 func (s stubConn) RemoteAddr() net.Addr { return s.remote }
 
-func TestClient_ConnectedIPParsesRemoteAddr(t *testing.T) {
+func TestConnectedIPParsesRemoteAddr(t *testing.T) {
 	tests := []struct {
 		name string
 		s    string
@@ -252,15 +250,12 @@ func TestClient_ConnectedIPParsesRemoteAddr(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			c := &Client{relayConn: stubConn{remote: staticAddr{s: tt.s}}}
-			got := c.ConnectedIP()
+			got := connectedIP(stubConn{remote: staticAddr{s: tt.s}})
 			var gotStr string
 			if got.IsValid() {
 				gotStr = got.String()
 			}
-			if gotStr != tt.want {
-				t.Errorf("ConnectedIP(%q) = %q, want %q", tt.s, gotStr, tt.want)
-			}
+			assert.Equal(t, tt.want, gotStr, "IP extracted from RemoteAddr %q", tt.s)
 		})
 	}
 }
diff --git a/shared/relay/client/manager.go b/shared/relay/client/manager.go
index 50fcc0b8f..367c6dfc5 100644
--- a/shared/relay/client/manager.go
+++ b/shared/relay/client/manager.go
@@ -256,11 +256,7 @@ func (m *Manager) RelayInstanceAddress() (string, netip.Addr, error) {
 	if m.relayClient == nil {
 		return "", netip.Addr{}, ErrRelayClientNotConnected
 	}
-	addr, err := m.relayClient.ServerInstanceURL()
-	if err != nil {
-		return "", netip.Addr{}, err
-	}
-	return addr, m.relayClient.ConnectedIP(), nil
+	return m.relayClient.serverInstanceAddress()
 }
 
 // ServerURLs returns the addresses of the relay servers.
diff --git a/shared/relay/client/manager_address_test.go b/shared/relay/client/manager_address_test.go
new file mode 100644
index 000000000..4f669e60d
--- /dev/null
+++ b/shared/relay/client/manager_address_test.go
@@ -0,0 +1,103 @@
+package client
+
+import (
+	"net/netip"
+	"runtime"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestManager_RelayInstanceAddressAcrossReconnect(t *testing.T) {
+	relays := []struct {
+		url  *RelayAddr
+		conn stubConn
+		ip   netip.Addr
+	}{
+		{
+			url:  &RelayAddr{addr: "rels://relay-a.example:443"},
+			conn: stubConn{remote: staticAddr{s: "192.0.2.1:443"}},
+			ip:   netip.MustParseAddr("192.0.2.1"),
+		},
+		{
+			url:  &RelayAddr{addr: "rels://relay-b.example:443"},
+			conn: stubConn{remote: staticAddr{s: "192.0.2.2:443"}},
+			ip:   netip.MustParseAddr("192.0.2.2"),
+		},
+	}
+	c := &Client{
+		instanceURL:      relays[0].url,
+		relayConn:        relays[0].conn,
+		serviceIsRunning: true,
+	}
+	m := &Manager{relayClient: c}
+	started := make(chan struct{})
+	stop := make(chan struct{})
+	done := make(chan struct{})
+	t.Cleanup(func() {
+		close(stop)
+		<-done
+	})
+	go func() {
+		defer close(done)
+		for i := 0; ; i++ {
+			select {
+			case <-stop:
+				return
+			default:
+			}
+			// Publish successive connection states using the lifecycle locks.
+			// Yield before publication so a getter using only muInstanceURL
+			// can read the old URL while waiting for the new connection's IP.
+			c.mu.Lock()
+			runtime.Gosched()
+			relay := relays[i%len(relays)]
+			c.muInstanceURL.Lock()
+			c.instanceURL = relay.url
+			c.muInstanceURL.Unlock()
+			c.relayConn = relay.conn
+			c.mu.Unlock()
+			if i == 0 {
+				close(started)
+			}
+		}
+	}()
+	<-started
+
+	for range 1000 {
+		url, ip, err := m.RelayInstanceAddress()
+		require.NoError(t, err)
+		wantIP := relays[0].ip
+		if url == relays[1].url.String() {
+			wantIP = relays[1].ip
+		}
+		if !assert.Equal(t, wantIP, ip, "advertised IP must belong to relay %s", url) {
+			return
+		}
+	}
+}
+
+func TestManager_RelayInstanceAddressDisconnected(t *testing.T) {
+	for _, tt := range []struct {
+		name   string
+		client *Client
+	}{
+		{name: "no client"},
+		{name: "not connected", client: &Client{}},
+		{
+			name: "closed connection",
+			client: &Client{
+				relayConn: stubConn{remote: staticAddr{s: "192.0.2.1:443"}},
+			},
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			m := &Manager{relayClient: tt.client}
+			url, ip, err := m.RelayInstanceAddress()
+			assert.Error(t, err)
+			assert.Empty(t, url, "disconnected relay must not advertise a URL")
+			assert.False(t, ip.IsValid(), "disconnected relay must not advertise a stale IP")
+		})
+	}
+}
diff --git a/shared/relay/client/picker.go b/shared/relay/client/picker.go
index 17b1390b1..fc1d8c1cb 100644
--- a/shared/relay/client/picker.go
+++ b/shared/relay/client/picker.go
@@ -63,7 +63,12 @@ func (sp *ServerPicker) PickServer(parentCtx context.Context) (*Client, error) {
 		if !ok {
 			return nil, <-errChan
 		}
-		log.Infof("chosen home Relay server: %s", cr.Url)
+		instanceURL, serverIP, err := cr.RelayClient.serverInstanceAddress()
+		if err != nil {
+			log.Infof("chosen home Relay server: %s, instance address unavailable: %v", cr.Url, err)
+			return cr.RelayClient, nil
+		}
+		log.Infof("chosen home Relay server: %s, instance URL: %s, server IP: %s", cr.Url, instanceURL, serverIP)
 		return cr.RelayClient, nil
 	case <-ctx.Done():
 		return nil, fmt.Errorf("connect to relay server: %w", ctx.Err())
diff --git a/upload-server/server/s3_test.go b/upload-server/server/s3_test.go
index a72356409..110b1b780 100644
--- a/upload-server/server/s3_test.go
+++ b/upload-server/server/s3_test.go
@@ -29,7 +29,7 @@ func Test_S3HandlerGetUploadURL(t *testing.T) {
 	ctx := context.Background()
 	c, err := testcontainers.GenericContainer(ctx, testcontainers.GenericContainerRequest{
 		ContainerRequest: testcontainers.ContainerRequest{
-			Image:        "minio/minio:RELEASE.2025-04-22T22-12-26Z",
+			Image:        "quay.io/minio/minio:RELEASE.2025-04-22T22-12-26Z",
 			ExposedPorts: []string{"9000/tcp"},
 			Env: map[string]string{
 				"MINIO_ROOT_USER":     "minioadmin",
diff --git a/util/serviceurl.go b/util/serviceurl.go
new file mode 100644
index 000000000..ffd287df1
--- /dev/null
+++ b/util/serviceurl.go
@@ -0,0 +1,69 @@
+package util
+
+import (
+	"net/url"
+	"strconv"
+	"strings"
+)
+
+// SameServiceURL reports whether two service URLs address the same endpoint.
+// One endpoint can be written several ways, and every spelling below reaches
+// the same server, so none of them is a divergence from another:
+//
+//	an implicit default port    https://mgmt.example.com   :443
+//	a zero-padded port          https://mgmt.example.com:0443
+//	a different host case       https://MGMT.example.com
+//	a trailing slash            https://mgmt.example.com/
+//
+// A path is otherwise part of the identity: https://mgmt.example.com and
+// https://mgmt.example.com/other are two endpoints.
+//
+// It lives here rather than next to any one caller because several of them
+// compare the same kind of URL — an MDM-enforced management URL against a
+// requested one, a stored profile URL against a command-line one — and every
+// copy of these rules that drifts turns an equivalent URL into a refused
+// request.
+func SameServiceURL(a, b *url.URL) bool {
+	if a == nil || b == nil {
+		return a == b
+	}
+
+	return strings.EqualFold(a.Hostname(), b.Hostname()) &&
+		strings.EqualFold(a.Scheme, b.Scheme) &&
+		ServiceURLPort(a) == ServiceURLPort(b) &&
+		strings.TrimSuffix(a.Path, "/") == strings.TrimSuffix(b.Path, "/")
+}
+
+// SameServiceURLStrings is SameServiceURL for unparsed input. Input that does
+// not parse falls back to string equality, which is the strictest thing left
+// to do with it.
+func SameServiceURLStrings(a, b string) bool {
+	ua, errA := url.ParseRequestURI(a)
+	ub, errB := url.ParseRequestURI(b)
+	if errA != nil || errB != nil {
+		return a == b
+	}
+
+	return SameServiceURL(ua, ub)
+}
+
+// ServiceURLPort is the port a URL addresses: the one it carries, normalized
+// numerically so ":0443" and ":443" are one port, or the scheme's default.
+func ServiceURLPort(u *url.URL) string {
+	port := u.Port()
+	if port == "" {
+		switch strings.ToLower(u.Scheme) {
+		case "https":
+			return "443"
+		case "http":
+			return "80"
+		default:
+			return ""
+		}
+	}
+
+	if n, err := strconv.Atoi(port); err == nil {
+		return strconv.Itoa(n)
+	}
+	return port
+}
diff --git a/util/serviceurl_test.go b/util/serviceurl_test.go
new file mode 100644
index 000000000..af32a7c29
--- /dev/null
+++ b/util/serviceurl_test.go
@@ -0,0 +1,73 @@
+package util
+
+import (
+	"net/url"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestSameServiceURLSpellings(t *testing.T) {
+	tests := []struct {
+		a, b string
+		want bool
+	}{
+		// One endpoint, written several ways.
+		{a: "https://mgmt.example.com", b: "https://mgmt.example.com:443", want: true},
+		{a: "https://mgmt.example.com", b: "https://mgmt.example.com/", want: true},
+		{a: "https://mgmt.example.com/", b: "https://mgmt.example.com:443/", want: true},
+		{a: "https://MGMT.example.com", b: "https://mgmt.example.com", want: true},
+		{a: "https://mgmt.example.com:0443", b: "https://mgmt.example.com:443", want: true},
+		{a: "http://mgmt.example.com", b: "http://mgmt.example.com:80", want: true},
+		{a: "HTTPS://mgmt.example.com", b: "https://mgmt.example.com", want: true},
+
+		// Different endpoints.
+		{a: "https://mgmt.example.com", b: "http://mgmt.example.com", want: false},
+		{a: "https://mgmt.example.com", b: "https://mgmt.example.com:8443", want: false},
+		{a: "https://mgmt.example.com", b: "https://other.example.com", want: false},
+		{a: "https://mgmt.example.com", b: "https://mgmt.example.com/other", want: false},
+
+		// Unparseable input falls back to string equality.
+		{a: "mgmt.example.com", b: "mgmt.example.com", want: true},
+		{a: "mgmt.example.com", b: "https://mgmt.example.com", want: false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.a+" vs "+tt.b, func(t *testing.T) {
+			assert.Equal(t, tt.want, SameServiceURLStrings(tt.a, tt.b))
+			assert.Equal(t, tt.want, SameServiceURLStrings(tt.b, tt.a), "the comparison must be symmetric")
+		})
+	}
+}
+
+// The parsed form is the primitive the string form delegates to, so it must
+// answer the same for a spelling that only the parser can tell apart.
+func TestSameServiceURLParsed(t *testing.T) {
+	parse := func(raw string) *url.URL {
+		t.Helper()
+		u, err := url.ParseRequestURI(raw)
+		require.NoError(t, err)
+		return u
+	}
+
+	assert.True(t, SameServiceURL(parse("https://mgmt.example.com:0443/"), parse("https://MGMT.example.com")))
+	assert.False(t, SameServiceURL(parse("https://mgmt.example.com"), parse("https://mgmt.example.com:8443")))
+
+	assert.True(t, SameServiceURL(nil, nil), "two absent URLs are the same absence")
+	assert.False(t, SameServiceURL(nil, parse("https://mgmt.example.com")))
+}
+
+func TestServiceURLPort(t *testing.T) {
+	parse := func(raw string) *url.URL {
+		t.Helper()
+		u, err := url.ParseRequestURI(raw)
+		require.NoError(t, err)
+		return u
+	}
+
+	assert.Equal(t, "443", ServiceURLPort(parse("https://mgmt.example.com")))
+	assert.Equal(t, "80", ServiceURLPort(parse("http://mgmt.example.com")))
+	assert.Equal(t, "443", ServiceURLPort(parse("https://mgmt.example.com:0443")))
+	assert.Equal(t, "8443", ServiceURLPort(parse("https://mgmt.example.com:8443")))
+}
diff --git a/util/wsproxy/server/proxy.go b/util/wsproxy/server/proxy.go
index ffb622200..0618beb91 100644
--- a/util/wsproxy/server/proxy.go
+++ b/util/wsproxy/server/proxy.go
@@ -1,12 +1,8 @@
 package server
 
 import (
-	"context"
-	"io"
-	"net"
 	"net/http"
-	"sync"
-	"time"
+	"sync/atomic"
 
 	"github.com/coder/websocket"
 	log "github.com/sirupsen/logrus"
@@ -15,11 +11,6 @@ import (
 	"github.com/netbirdio/netbird/util/wsproxy"
 )
 
-const (
-	bufferSize = 32 * 1024
-	ioTimeout  = 5 * time.Second
-)
-
 // Config contains the configuration for the WebSocket proxy.
 type Config struct {
 	Handler         http.Handler
@@ -53,14 +44,23 @@ func New(handler http.Handler, opts ...Option) *Proxy {
 
 // Handler returns an http.Handler that proxies WebSocket connections to the local gRPC server.
 func (p *Proxy) Handler() http.Handler {
-	return http.HandlerFunc(p.handleWebSocket)
+	return &proxyHandler{
+		metrics: p.config.MetricsRecorder,
+		handler: p.config.Handler,
+	}
 }
 
-func (p *Proxy) handleWebSocket(w http.ResponseWriter, r *http.Request) {
+type proxyHandler struct {
+	metrics MetricsRecorder
+	handler http.Handler
+	conn    atomic.Pointer[wsConnAdapter]
+}
+
+func (ph *proxyHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	ctx := r.Context()
 
-	p.metrics.RecordConnection(ctx)
-	defer p.metrics.RecordDisconnection(ctx)
+	ph.metrics.RecordConnection(ctx)
+	defer ph.metrics.RecordDisconnection(ctx)
 
 	log.Debugf("WebSocket proxy handling connection from %s, forwarding to internal gRPC handler", r.RemoteAddr)
 	acceptOptions := &websocket.AcceptOptions{
@@ -69,121 +69,44 @@ func (p *Proxy) handleWebSocket(w http.ResponseWriter, r *http.Request) {
 
 	wsConn, err := websocket.Accept(w, r, acceptOptions)
 	if err != nil {
-		p.metrics.RecordError(ctx, "websocket_accept_failed")
+		ph.metrics.RecordError(ctx, "websocket_accept_failed")
 		log.Errorf("WebSocket upgrade failed from %s: %v", r.RemoteAddr, err)
 		return
 	}
-	defer func() {
-		_ = wsConn.Close(websocket.StatusNormalClosure, "")
-	}()
+	serverConn := (&wsConnAdapter{
+		ctx:        ctx,
+		conn:       wsConn,
+		metrics:    ph.metrics,
+		clientAddr: r.RemoteAddr,
+	})
 
-	clientConn, serverConn := net.Pipe()
 	defer func() {
-		_ = clientConn.Close()
 		_ = serverConn.Close()
 	}()
 
+	ph.conn.Store(serverConn) // used in tests only
+
 	log.Debugf("WebSocket proxy established: %s -> gRPC handler", r.RemoteAddr)
 
-	go func() {
-		(&http2.Server{}).ServeConn(serverConn, &http2.ServeConnOpts{
-			Context: ctx,
-			Handler: p.config.Handler,
-		})
-	}()
+	(&http2.Server{
+		// TODO (dmitri) we should limit the number of concurrent streams per connection (peer)
+		// and idle timeouts
+		// MaxConcurrentStreams: 20,
+		// IdleTimeout: 10 * time.Second,
+	}).ServeConn(serverConn, &http2.ServeConnOpts{
+		Context:    ctx,
+		Handler:    ph.handler,
+		BaseConfig: &http.Server{
+			// b/c we are wrapping a ws connection, read and write connection deadlines normally set
+			// via ReadTimeout and WriteTimeout http.Server fields aren't available to us. The ws
+			// library doesn't expose connection deadline timer config, and we ignore these calls in "wsConnAdapter".
+			//
+			// Another issue is that Server.ServeConn() call bypasses setting of connection deadlines altogether,
+			// ReadTimeout and Writetimeout set here would only apply to h2 streams, i.e. after a HEADERS frame
+			// arrival and processing, turning ReadTimeout into a request body read deadline, and WriteTimeout into
+			// a response deadline (the latter not useful for streaming requests).
+		},
+	})
 
-	p.proxyData(ctx, wsConn, clientConn, r.RemoteAddr)
-}
-
-func (p *Proxy) proxyData(ctx context.Context, wsConn *websocket.Conn, pipeConn net.Conn, clientAddr string) {
-	proxyCtx, cancel := context.WithCancel(ctx)
-	defer cancel()
-
-	var wg sync.WaitGroup
-	wg.Add(2)
-
-	go p.wsToPipe(proxyCtx, cancel, &wg, wsConn, pipeConn, clientAddr)
-	go p.pipeToWS(proxyCtx, cancel, &wg, wsConn, pipeConn, clientAddr)
-
-	wg.Wait()
-}
-
-func (p *Proxy) wsToPipe(ctx context.Context, cancel context.CancelFunc, wg *sync.WaitGroup, wsConn *websocket.Conn, pipeConn net.Conn, clientAddr string) {
-	defer wg.Done()
-	defer cancel()
-
-	for {
-		msgType, data, err := wsConn.Read(ctx)
-		if err != nil {
-			switch {
-			case ctx.Err() != nil:
-				log.Debugf("WebSocket from %s terminating due to context cancellation", clientAddr)
-			case websocket.CloseStatus(err) != -1:
-				log.Debugf("WebSocket from %s disconnected", clientAddr)
-			default:
-				p.metrics.RecordError(ctx, "websocket_read_error")
-				log.Debugf("WebSocket read error from %s: %v", clientAddr, err)
-			}
-			return
-		}
-
-		if msgType != websocket.MessageBinary {
-			log.Warnf("Unexpected WebSocket message type from %s: %v", clientAddr, msgType)
-			continue
-		}
-
-		if ctx.Err() != nil {
-			log.Tracef("wsToPipe goroutine terminating due to context cancellation before pipe write")
-			return
-		}
-
-		if err := pipeConn.SetWriteDeadline(time.Now().Add(ioTimeout)); err != nil {
-			log.Debugf("Failed to set pipe write deadline: %v", err)
-		}
-
-		n, err := pipeConn.Write(data)
-		if err != nil {
-			p.metrics.RecordError(ctx, "pipe_write_error")
-			log.Warnf("Pipe write error for %s: %v", clientAddr, err)
-			return
-		}
-
-		p.metrics.RecordBytesTransferred(ctx, "ws_to_grpc", int64(n))
-	}
-}
-
-func (p *Proxy) pipeToWS(ctx context.Context, cancel context.CancelFunc, wg *sync.WaitGroup, wsConn *websocket.Conn, pipeConn net.Conn, clientAddr string) {
-	defer wg.Done()
-	defer cancel()
-
-	buf := make([]byte, bufferSize)
-	for {
-		n, err := pipeConn.Read(buf)
-		if err != nil {
-			if ctx.Err() != nil {
-				log.Tracef("pipeToWS goroutine terminating due to context cancellation")
-				return
-			}
-
-			if err != io.EOF {
-				log.Debugf("Pipe read error for %s: %v", clientAddr, err)
-			}
-			return
-		}
-
-		if ctx.Err() != nil {
-			log.Tracef("pipeToWS goroutine terminating due to context cancellation before WebSocket write")
-			return
-		}
-
-		if n > 0 {
-			if err := wsConn.Write(ctx, websocket.MessageBinary, buf[:n]); err != nil {
-				p.metrics.RecordError(ctx, "websocket_write_error")
-				log.Warnf("WebSocket write error for %s: %v", clientAddr, err)
-				return
-			}
-
-			p.metrics.RecordBytesTransferred(ctx, "grpc_to_ws", int64(n))
-		}
-	}
+	log.Debugf("WebSocket proxy closing: %s -> gRPC handler", r.RemoteAddr)
 }
diff --git a/util/wsproxy/server/ws_conn_adapter.go b/util/wsproxy/server/ws_conn_adapter.go
new file mode 100644
index 000000000..eb29ab0cb
--- /dev/null
+++ b/util/wsproxy/server/ws_conn_adapter.go
@@ -0,0 +1,126 @@
+package server
+
+import (
+	"context"
+	"net"
+	"sync/atomic"
+	"time"
+
+	"github.com/coder/websocket"
+	log "github.com/sirupsen/logrus"
+)
+
+type wsConnAdapter struct {
+	prefix       string
+	ctx          context.Context
+	conn         *websocket.Conn
+	metrics      MetricsRecorder
+	clientAddr   string
+	closed       atomic.Bool
+	bufferedRead []byte
+}
+
+var _ net.Conn = &wsConnAdapter{}
+
+type wsAddr struct{ prefix string }
+
+func (wa wsAddr) Network() string { return wa.prefix + "ws-proxy" }
+func (wa wsAddr) String() string  { return wa.prefix + "ws-proxy" }
+
+func (ws *wsConnAdapter) Read(b []byte) (int, error) {
+	if len(ws.bufferedRead) > 0 {
+		return ws.readFromBuffer(b)
+	}
+
+	msgType, data, err := ws.conn.Read(ws.ctx)
+	if err != nil {
+		switch {
+		case ws.ctx.Err() != nil:
+			log.Debugf("WebSocket from %s terminating due to context cancellation", ws.clientAddr)
+		case websocket.CloseStatus(err) != -1:
+			log.Debugf("WebSocket from %s disconnected", ws.clientAddr)
+		default:
+			ws.recordError(ws.ctx, "websocket_read_error")
+			log.Debugf("WebSocket read error from %s: %v", ws.clientAddr, err)
+		}
+		return copy(b, data), err
+	}
+	if msgType != websocket.MessageBinary {
+		log.Warnf("Unexpected WebSocket message type from %s: %v", ws.clientAddr, msgType)
+		return 0, nil
+	}
+
+	ws.bufferedRead = data
+	return ws.readFromBuffer(b)
+}
+
+func (ws *wsConnAdapter) readFromBuffer(b []byte) (int, error) {
+	n := copy(b, ws.bufferedRead)
+
+	ws.recordBytesTransferred(ws.ctx, "ws_to_grpc", n)
+	if n == len(ws.bufferedRead) {
+		ws.bufferedRead = nil
+		return n, nil
+	} else {
+		ws.bufferedRead = ws.bufferedRead[n:]
+	}
+	return n, nil
+}
+
+func (ws *wsConnAdapter) Write(b []byte) (int, error) {
+	maybeErr := ws.ctx.Err()
+
+	n := len(b)
+	if n == 0 {
+		return n, maybeErr
+	}
+	if maybeErr != nil {
+		return 0, maybeErr
+	}
+	if err := ws.conn.Write(ws.ctx, websocket.MessageBinary, b[:n]); err != nil {
+		ws.recordError(ws.ctx, "websocket_write_error")
+		log.Warnf("WebSocket write error for %s: %v", ws.clientAddr, err)
+		return 0, err // we don't know how many bytes have been written
+	}
+
+	ws.recordBytesTransferred(ws.ctx, "grpc_to_ws", n)
+	return n, nil
+}
+
+func (ws *wsConnAdapter) Close() error {
+	ws.closed.Store(true)
+	return ws.conn.Close(websocket.StatusNormalClosure, "")
+}
+
+func (ws *wsConnAdapter) LocalAddr() net.Addr  { return wsAddr{ws.prefix} }
+func (ws *wsConnAdapter) RemoteAddr() net.Addr { return wsAddr{ws.prefix} }
+
+func (ws *wsConnAdapter) SetDeadline(t time.Time) error {
+	return nil
+}
+
+func (ws *wsConnAdapter) SetReadDeadline(t time.Time) error {
+	return nil
+}
+
+func (ws *wsConnAdapter) SetWriteDeadline(t time.Time) error {
+	return nil
+}
+
+func (ws *wsConnAdapter) recordError(ctx context.Context, errorType string) {
+	if ws.metrics == nil {
+		return
+	}
+	ws.metrics.RecordError(ctx, errorType)
+}
+
+func (ws *wsConnAdapter) recordBytesTransferred(ctx context.Context, direction string, bytes int) {
+	if ws.metrics == nil {
+		return
+	}
+	ws.metrics.RecordBytesTransferred(ctx, direction, int64(bytes))
+}
+
+func (ws *wsConnAdapter) IsClosed() bool {
+	return ws.closed.Load()
+}
diff --git a/util/wsproxy/server/ws_conn_adapter_test.go b/util/wsproxy/server/ws_conn_adapter_test.go
new file mode 100644
index 000000000..d46e4830b
--- /dev/null
+++ b/util/wsproxy/server/ws_conn_adapter_test.go
@@ -0,0 +1,204 @@
+package server
+
+import (
+	"bytes"
+	"context"
+	"crypto/tls"
+	"io"
+	"math/rand/v2"
+	"net"
+	"net/http"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/coder/websocket"
+	"github.com/stretchr/testify/assert"
+	"golang.org/x/net/http2"
+	"golang.org/x/net/http2/hpack"
+)
+
+func TestAdapterHandlingConnectionClosures(t *testing.T) {
+	var cases = []struct {
+		description string
+		casenum     int
+	}{
+		{"client-side ws connection is closed", 0},
+		{"server-side ws connection is closed", 1},
+		{"client-side context is cancelled", 2},
+		{"server-side context is cancelled", 3},
+	}
+
+	for _, c := range cases {
+		t.Run(c.description, func(t *testing.T) {
+			serversock := filepath.Join(os.TempDir(), "http-server-"+strconv.FormatInt(rand.Int64(), 10)+".sock")
+			t.Cleanup(func() { os.Remove(serversock) })
+
+			l, err := net.Listen("unix", serversock)
+			assert.NoError(t, err)
+
+			proxy := New(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				buf, _ := io.ReadAll(r.Body)
+				defer r.Body.Close()
+				w.Write([]byte("echo: " + string(buf))) //nolint:errcheck
+			}))
+
+			handler, ok := proxy.Handler().(*proxyHandler)
+			assert.True(t, ok)
+
+			protocols := new(http.Protocols)
+			protocols.SetHTTP1(true)
+			protocols.SetUnencryptedHTTP2(true)
+			httpServer := http.Server{
+				Handler: handler,
+			}
+			go httpServer.Serve(l) //nolint:errcheck
+			t.Cleanup(func() { httpServer.Close() })
+
+			clientconn, _, err := websocket.Dial(context.Background(), "http://whatever", //nolint:bodyclose
+				&websocket.DialOptions{HTTPClient: &http.Client{
+					Transport: &http.Transport{
+						DialContext: func(_ context.Context, _, _ string) (net.Conn, error) {
+							return net.Dial("unix", serversock)
+						},
+					}}})
+			assert.NoError(t, err)
+
+			clientCtx, cancel := context.WithCancel(context.Background()) //nolint:govet
+			h2client := &http.Client{
+				Transport: &http2.Transport{
+					AllowHTTP: true,
+					DialTLSContext: func(_ context.Context, _, _ string, _ *tls.Config) (net.Conn, error) {
+						return &wsConnAdapter{
+							prefix: "test-client",
+							ctx:    clientCtx,
+							conn:   clientconn,
+						}, nil
+					},
+				}}
+
+			resp, err := h2client.Post("http://whatever", "text/html", strings.NewReader("g'day"))
+			assert.NoError(t, err)
+
+			body, err := io.ReadAll(resp.Body)
+			defer resp.Body.Close()
+
+			assert.NoError(t, err)
+			assert.Equal(t, "echo: g'day", string(body))
+
+			switch c.casenum {
+			case 0:
+				clientconn.Close(websocket.StatusNormalClosure, "")
+			case 1:
+				handler.conn.Load().Close()
+			case 2:
+				cancel()
+			case 3:
+				resp.Body.Close()
+				h2client.CloseIdleConnections()
+			}
+
+			assert.EventuallyWithT(t, func(c *assert.CollectT) {
+				assert.True(c, handler.conn.Load().IsClosed())
+			}, 3*time.Second, 100*time.Millisecond)
+		}) //nolint:govet
+	}
+}
+
+func TestAdapterHandlingHttpConnection_NoHeadersSent(t *testing.T) {
+	t.Skip("currently disabled as it requires idle timeout to be set")
+
+	serversock := filepath.Join(os.TempDir(), "http-server-"+strconv.FormatInt(rand.Int64(), 10)+".sock")
+	defer os.Remove(serversock)
+
+	l, err := net.Listen("unix", serversock)
+	assert.NoError(t, err)
+
+	proxy := New(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		buf, _ := io.ReadAll(r.Body)
+		defer r.Body.Close()                    //nolint:errcheck
+		w.Write([]byte("echo: " + string(buf))) //nolint:errcheck
+	}))
+
+	handler, ok := proxy.Handler().(*proxyHandler)
+	assert.True(t, ok)
+
+	protocols := new(http.Protocols)
+	protocols.SetHTTP1(true)
+	protocols.SetUnencryptedHTTP2(true)
+	httpServer := http.Server{
+		Handler: handler,
+	}
+	go httpServer.Serve(l) //nolint:errcheck
+
+	clientconn, _, err := websocket.Dial(context.Background(), "http://whatever", //nolint:bodyclose
+		&websocket.DialOptions{HTTPClient: &http.Client{
+			Transport: &http.Transport{
+				DialContext: func(_ context.Context, _, _ string) (net.Conn, error) {
+					return net.Dial("unix", serversock)
+				},
+			}}})
+	assert.NoError(t, err)
+
+	h2client := &http.Client{
+		Transport: &http2.Transport{
+			AllowHTTP: true,
+			DialTLSContext: func(_ context.Context, _, _ string, _ *tls.Config) (net.Conn, error) {
+				return &h2ConnectionSnooper{wrappedConn: &wsConnAdapter{
+					prefix: "test-client",
+					ctx:    context.Background(),
+					conn:   clientconn,
+				}, shouldDropFrame: func(f http2.FrameType) bool { return f == http2.FrameHeaders || f == http2.FrameData }}, nil
+			},
+		}}
+
+	_, err = h2client.Post("http://whatever", "text/html", strings.NewReader("g'day"))
+	assert.Error(t, err)
+
+	assert.EventuallyWithT(t, func(c *assert.CollectT) {
+		assert.True(c, handler.conn.Load().IsClosed())
+	}, 3*time.Second, 100*time.Millisecond)
+}
+
+type h2ConnectionSnooper struct {
+	wrappedConn     net.Conn
+	shouldDropFrame func(f http2.FrameType) bool
+}
+
+func (hs *h2ConnectionSnooper) Read(b []byte) (n int, err error) {
+	return hs.wrappedConn.Read(b)
+}
+
+func (hs *h2ConnectionSnooper) Write(b []byte) (n int, err error) {
+	fr := http2.NewFramer(nil, bytes.NewReader(b))
+	fr.ReadMetaHeaders = hpack.NewDecoder(0, nil)
+	f, err := fr.ReadFrame()
+	if err != nil {
+		return hs.wrappedConn.Write(b)
+	}
+
+	if hs.shouldDropFrame != nil && hs.shouldDropFrame(f.Header().Type) {
+		return len(b), nil
+	}
+
+	return hs.wrappedConn.Write(b)
+}
+
+func (hs *h2ConnectionSnooper) Close() error { return hs.wrappedConn.Close() }
+
+func (hs *h2ConnectionSnooper) LocalAddr() net.Addr { return hs.wrappedConn.LocalAddr() }
+
+func (hs *h2ConnectionSnooper) RemoteAddr() net.Addr { return hs.wrappedConn.RemoteAddr() }
+
+func (hs *h2ConnectionSnooper) SetDeadline(t time.Time) error { return hs.wrappedConn.SetDeadline(t) }
+
+func (hs *h2ConnectionSnooper) SetReadDeadline(t time.Time) error {
+	return hs.wrappedConn.SetReadDeadline(t)
+}
+
+func (hs *h2ConnectionSnooper) SetWriteDeadline(t time.Time) error {
+	return hs.wrappedConn.SetWriteDeadline(t)
+}